diff --git a/cfengine.SuSEfirewall2 b/cfengine.SuSEfirewall2
new file mode 100644
index 0000000..decd296
--- /dev/null
+++ b/cfengine.SuSEfirewall2
@@ -0,0 +1,6 @@
+## Name: CFEngine server
+## Description: opens ports for CFEngine server in order to be used as a policy hub
+
+# space separated list of allowed ports
+TCP="5308"
+
diff --git a/cfengine.changes b/cfengine.changes
index 1b629c8..a8a156b 100644
--- a/cfengine.changes
+++ b/cfengine.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Thu Apr  3 13:10:56 UTC 2014 - kkaempf@suse.com
+
+- install cfengine.SuSEfirewall2
+
 -------------------------------------------------------------------
 Thu Apr  3 12:41:44 UTC 2014 - kkaempf@suse.com
 
diff --git a/cfengine.spec b/cfengine.spec
index 43a581e..9d9ccd4 100644
--- a/cfengine.spec
+++ b/cfengine.spec
@@ -37,6 +37,7 @@ Version:        3.6.0b2
 Release:        0
 Url:            http://www.cfengine.org/
 Source:         %{srcname}-%{version}.tar.gz
+Source1:        %{name}.SuSEfirewall2
 
 BuildRequires:  %{name}-masterfiles = %{version}
 
@@ -304,6 +305,10 @@ do
   gzip %{buildroot}%{_mandir}/man8/$i.8
 done
 
+%if 0%{?suse_version} > 1010
+install -D -m 644 %{S:1} $RPM_BUILD_ROOT%{_sysconfdir}/sysconfig/SuSEfirewall2.d/services/cfengine
+%endif
+
 %if 0%{?suse_version} > 01020
 %fdupes %{buildroot}/usr/share/cfengine
 %endif