> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cc-hardware/controllers/controller-6000/troubleshoot/controller-6000-firewall-issues.md).

# Firewall issues

Diagnose firewall rules that prevent a Controller 6000 from connecting to Command Centre.

If the Windows Firewall is on and has not been correctly configured, it may block connections to the controllers.

## Quick test

A quick method to test whether a Firewall issue is causing controllers to stay offline is to **turn the Firewall off**. If the controllers then come online, the firewall is the issue.

> ⚠️ **Restore the firewall** after testing. Never leave it off as a permanent fix.

***

## Initial configuration during Command Centre install

* When Command Centre is installed, part of the installation is to **add Windows Firewall rules** automatically.
* If controllers or Workstations will be on **different subnets to the server PC**, **un-tick the "Allow communication on local subnet only"** option when installing Command Centre.

***

## Adding rules to Windows Firewall after Command Centre is installed

1. Open Windows Firewall by clicking **Start** > **Control Panel** > search "firewall" > **Windows Firewall**.
2. In the left pane click **Advanced settings**. If prompted for admin password or confirmation, provide it.
3. In the **Windows Firewall with Advanced Security** dialog, in the left pane click **Inbound Rules**, then in the right pane click **New Rule**.
4. Follow the instructions in the **New Inbound Rule** wizard.

Add new Program rules for:

| Program            | Service                   |
| ------------------ | ------------------------- |
| `CCNTBertServ.exe` | FT Controller Service     |
| `CCNTSad.exe`      | FT Command Centre Service |

***

## Updating an existing rule (for example, a scope change)

From the **Inbound Rules** panel, click the rule to modify (for example, **FT Controller Service**, the service that talks to the controllers).

If you had restricted connections to the local subnet only during installation, you can change this from the **Scope** tab of the Inbound Rule properties:

* Add additional scopes, or
* Allow **Any IP address**.

***

The firewall configuration approach is identical between the C6000 and the C7000. See the C7000 equivalent at [Controller 7000 - Firewall Issues](/knowledge-hub/products/cc-hardware/controllers/controller-7000-and-7000-sdc/troubleshoot/controller-7000-firewall-issues.md).

***

🔗 **Related**

* [Controller 7000 - Firewall Issues](/knowledge-hub/products/cc-hardware/controllers/controller-7000-and-7000-sdc/troubleshoot/controller-7000-firewall-issues.md). The same approach on the C7000.
* [Bringing online and networking](/knowledge-hub/products/cc-hardware/controllers/controller-6000/configure/controller-6000-bringing-online-and-ne.md). The wider bringing-online workflow.
* [Testing Controller Connections](/knowledge-hub/products/cc-hardware/controllers/controller-6000/troubleshoot/controller-6000-testing-controller-connections.md). Confirming port 1072 is reachable.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://help.security.gallagher.com/knowledge-hub/products/cc-hardware/controllers/controller-6000/troubleshoot/controller-6000-firewall-issues.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.