---
title: "Segmenting network architecture and ports"
slug: "segmenting-network-architecture-and-ports"
tags: ["Product Usage", "ePolicy Orchestrator – On-prem", "ePO 5.10.x", "ePO 5.10.0"]
updated: 2026-09-07T17:46:26Z
published: 2026-09-07T17:46:26Z
canonical: "docs.trellix.com/segmenting-network-architecture-and-ports"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trellix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Segmenting network architecture and ports

Isolate deployment components to maintain data confidentiality, integrity, and availability during network events.

### Dedicated management zone

Place the ePO Server, Agent Handlers, and the SQL Server database inside a restricted Management Security Zone (Isolated VLAN). Block inbound traffic from general user workstations and standard server segments except through designated product ports.

For requirements and traffic details, see [Ports required for communicating through a firewall](/v1/docs/ports-required-for-communicating-through-a-firewall).

### Distributed repositories and SuperAgents

Deploy Distributed Repositories or SuperAgents to localize content and definition updates across your architecture. For details, see [Best practice: SuperAgent repositories](/v1/docs/best-practice-superagent-repositories).

- Mitigates single points of network failure.
- Preserves network bandwidth across WAN links.
- Enforces HTTPS across all communication channels between Distributed Repositories, Agent Handlers, and Source Sites.

### Host-based firewall hardening

Use a host-based firewall on the operating system to restrict incoming connections to the ePO server, allowing traffic only from validated Agent Handlers and managed subnets.