To create a Horizon Edge deployment and install or update appliance modules, you must allow the appropriate URLs on the respective ports.
Important: For the table that follows, the listed purposes are in the context of a Horizon Edge Gateway with Horizon Connection Server.
Allow URLs for the Management Subnet
Allow the appropriate URLs and wildcard subdomains according to your site location and needs. More specifically, perform the following tasks.
- Allow the URLs and wildcard subdomains in the table that follows. For example, by adding the URLs and wildcard subdomain to an allow list for the firewall.
- Bypass SSL deep packet inspection as follows.
-
In the firewall for the URLs and wildcard subdomains in the table that follows.
-
In the proxy server, if applicable.
If the Horizon Edge Gateway is connected to the Horizon Cloud control plane through a proxy server, bypass SSL deep packet inspection in the proxy server for the URLs and wildcard subdomains in the table that follows.
-
| Destination (DNS name) | Port | Protocol | Purpose |
|---|---|---|---|
| registry.k8s.io | 443 | TCP | Used for programmatic access to allow images to download as and when required. Used for downloading Docker images to create the required Horizon Edge modules, which are useful for monitoring, SSO, UAG updates, and such.
Note: Applies to Horizon Edge Gateway deployment 2412 only. |
| *.blob.core.windows.net | 443 | TCP | Used for programmatic access to the Azure Blob Storage and to upload the Horizon Edge logs as and when required. Used for downloading Docker images to create the required Horizon Edge modules, which are useful for monitoring, SSO, UAG updates, and such. |
| horizonedgeprod.azurecr.io | 443 | TCP | Used for authentication while downloading Docker images to create the required Horizon Edge modules, which are useful for monitoring, SSO, UAG updates, and such. |
|
*.azure-devices.net, or one of the region-specific names that follows, depending on which regional control plane applies to your tenant account North America:
| 443 | TCP (requirement means HTTP, HTTPS, and WSS) | Used to connect the appliance to the Horizon Cloud control plane, to download configurations for the appliance's module, and to update the appliance's module's runtime status. |
*.data.workspaceone.com, or one of the region-specific names that follow, depending on which regional Workspace ONE Intelligence target applies to your tenant account:
| 443 | TCP | Used for sending events or metrics to Workspace ONE Intelligence. |
Using IP Addresses Instead of URLs
For situations where using URLs is not possible, see KB 6000374 - IP Addresses for Service Components.
Was this page helpful?