diff --git a/it-windows-base/CHANGELOG.md b/it-windows-base/CHANGELOG.md
index 4ebdfc6..07e5f43 100644
--- a/it-windows-base/CHANGELOG.md
+++ b/it-windows-base/CHANGELOG.md
@@ -3,4 +3,5 @@
 
 # v1.1 -- 20210119
   * add EnCase source 148.129.71.121 to 4445/tcp (ticket INC000002587282)
+  * add Riverbed Transaction Agent (formerly appcapture) 172.24.100.107 to 27401/tcp
 
diff --git a/it-windows-base/ports.tf b/it-windows-base/ports.tf
index 5470508..b61bb5e 100644
--- a/it-windows-base/ports.tf
+++ b/it-windows-base/ports.tf
@@ -23,6 +23,7 @@ locals {
   n_backup      = ["10.193.0.0/22"]
   n_ansible     = ["172.24.12.239/32"]
   n_encase      = ["148.129.121.72/32"]
+  n_riverbed    = ["172.24.100.107/32"]
   source_groups = ["all", "external"]
   name          = var.name
   ports = [
@@ -34,6 +35,7 @@ locals {
     [3389, 3389, "tcp", "RDP", local.n_census, ["external"]],
     [4445, 4445, "tcp", "EnCase", local.n_encase, ["external"]],
     [5986, 5986, "tcp", "WinRM-https", local.n_ansible, ["external"]],
+    [27401, 27401, "tcp", "TransactionAgent", local.n_riverbed, ["external"]],
   ]
 
   # these are ignored