TFS 2017 server required firewall settings for Build agent

Question

I have TFS 2017 on Windows Server 2016 Standard.

I am now setting up Build agent on Windows 10 pro using PAT token authentication. (having "Agent Pools (read, manage)", "Agent Pools (read)", "Build (read"), "Code (read)", "Build (read and execute)", though this part seeems to be fine.

I am getting close to the very end of the configuration

Testing agent connection.
An error occured while sending the request.

Log file says

[2017-06-27 14:58:18Z ERR Agent] System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.Http.WinHttpException: Der Servername oder die Serveradresse konnte nicht verarbeitet werden at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Net.Http.WinHttpHandler.d__101.MoveNext() --- End of inner exception stack trace --- at Microsoft.VisualStudio.Services.Common.VssHttpRetryMessageHandler.d__3.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Net.Http.HttpClient.d__58.MoveNext()

More by chance (since this is nowhere mentioned as required) I disabled the firewall on the server and now the connection and configuration of the build agent goes to the very end.

I definitely have 443 and 80 open, I am using TFS via https/443 and also entered that in the build agent config. In the TFS console, I see :80 and :443, nothing like :8080.

What else do I need to consider?

TFS server is in a domain, build agent is not, https certificate is self-signed and added to Root CAs on build agent.

double check this post around ports visualstudio.com/en-us/docs/setup-admin/tfs/architecture/… — kevchadders
I did, though it does not seem relevant. SQL Ports? I would hope the build agent uses https and not directly go against the database (with what credentials anyway), same for other programs mentioned. Or am I missing something there? — Andreas Reiff
The SQL ports relate to the backend SQL database where the TFS databases are hosted. Sounds like you resolved it below. — kevchadders
Yes. And some ports like 1434 are mentioned in the page you linked, though with TCP protocol. No idea why it looks like only I had this issue. — Andreas Reiff

Andreas Reiff Andreas Reiff · Accepted Answer · 2017-06-27T18:01:05

After opening all TCP ports outgoing and incoming and doing some "netstat -a", I also tried UDP.

After some testing and "binary search", I opened UDP 1434 and now the

Testing agent connection

results in asking for the _work folder.

Update:

After ~ 5 builds I got "An error occured while sending the request.. retry every 15 seconds..", looks like opening 5353 and 5355 UDP fixes this for now.

TFS 2017 server required firewall settings for Build agent

1 Answers