Considering Security Requirements

There are two types of authentication for a database mirroring session: Windows Authentication (NTLM or Kerberos) or certificates. After a database mirroring session is initialized, the principal server sends a load of transaction logs to the mirror server using TCP. In addition to transporting log files between the two partners in a database mirroring session, TCP is used by the witness server to monitor the state of the two partners and determine when an automatic failover is necessary. In fact, all communication between the principal server, the mirror server, and the witness server (if available) is done through TCP over a specified port on each server.