---
schema_version: "1"
id: 0616a12e3a72cf3222e6935d0b2f76589a464c9abc8746ae156c84673aaf0c68
title: Requirements and Limits for Flex Gateway
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.12/flex-review-prerequisites.md
canonical_url: https://docs.mulesoft.com/gateway/1.12/flex-review-prerequisites
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 45fbc3f496addda88305c914ea51888993276c88c1097c2f98a115fc2914cc41
description: MuleSoft Documentation Site
release: "1.12"
latest: false
---
---
product: Omni Gateway
version: 1.12
---

# Requirements and Limits for Flex Gateway

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Before you download and install Anypoint Flex Gateway, review the following requirements and limits.

## Flex Gateway Requirements

### Permission Requirements

To use Flex Gateway you must have these permissions:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Permission</th><th>Ability</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Manage Servers</p></div></div></td><td><div><div><p>Create, update, and delete server and Flex Gateway resources.</p></div></div></td><td><div><div><p>Runtime Manager permission, which is assigned to a specific environment in a Business Group.</p></div></div></td></tr><tr><td><div><div><p>Read Servers</p></div></div></td><td><div><div><p>View server and Flex Gateway resources.</p></div></div></td><td><div><div><p>Runtime Manager permission, which is assigned to a specific environment in a Business Group.</p></div></div></td></tr><tr><td><div><div><p>Usage Viewer</p></div></div></td><td><div><div><p>View gateway metrics.</p></div></div></td><td><div><div><p>Usage permission, which can be added only by an organization administrator at the root organization level.</p></div></div></td></tr></tbody></table>

Your Anypoint Platform Admin can add these permissions in Access Management. See
[Manage Team Permissions](https://docs.mulesoft.com/access-management/configure-teams#manage-team-permissions) for more
information.

### Connected App Scope Requirements

To register Self-Managed Flex Gateway using a Connected App, the following scopes are required:

- Manage Servers

- Read Servers

- View Organization

## Managed Flex Gateway Resource Requirements

To use Managed Flex Gateway your Business Group must have at least one of these Managed Flex Gateway
resources:

- Large Managed Flex Gateways

- Small Managed Flex Gateways

Deploying an Extra Large Managed Flex Gateway requires two Large Managed Flex Gateways resources.

These resources aren’t inherited. To redistribute Managed Flex Gateway resources to a business
group, see
[Redistribute Resources Between Existing Business Groups](https://docs.mulesoft.com/access-management/business-groups#redistribute-resources).

## Managed Flex Gateway Private Space Requirement

To use Managed Flex Gateway, you have created a private space in CloudHub 2.0 or have access to a
private space created by someone else.

To create a private space, see [Creating Private Spaces](https://docs.mulesoft.com/cloudhub-2/ps-create-configure).

## Software Requirements for Self-Managed Flex Gateway

Flex Gateway isn’t supported on Windows or in Docker running on Windows.

### Software Requirements for Kubernetes and OpenShift Deployments

Running Flex Gateway requires:

- A minimum of either Kubernetes 1.21 or OpenShift 4.8.

- Ingress v1 (stable), which requires specifying `apiVersion: networking.k8s.io/v1` as the API
  version in your configuration resources.

- A private cloud or data center.

  Or, a cloud provider such as the following:

  - Google Kubernetes Engine (GKE)

  - Amazon Elastic Kubernetes Service (Amazon EKS)

  - Azure Kubernetes Service (AKS)

- A minimum Helm version of 3.0.0 is required.

### Software Requirements for Linux Deployments

Flex Gateway runs on the following Long Term Support (LTS) versions of Linux:

- Amazon Linux 2023

- CentOS 8

- Debian Bookworm

- Red Hat Enterprise Linux (9)

- Red Hat Enterprise Linux (9) on IBM Power (ppc64le)

- Ubuntu Jammy

Flex Gateway is designed to run in cloud-native architectures. Therefore, multiple installations on
a single Linux VM aren’t supported. You can install only one gateway instance per Linux VM.

### Software Requirements for Container Deployments

Flex Gateway supports the following:

- Docker

- Podman

Additionally, Flex Gateway supports the following container orchestration services:

- Amazon Elastic Container Service (Amazon ECS)

- Azure Container Service (ACS)

- Google Cloud Run

- AWS Fargate

## Hardware Requirements for Self-Managed Flex Gateway

A single Flex Gateway can support multiple backend APIs. To support more backend APIs, you can
deploy multiple replicas or additional Flex Gateways. For information about sizing, refer to
[Resource Sizing for Self-Managed Flex Gateway](https://docs.mulesoft.com/gateway/1.12/flex-sizing-guide).

Flex Gateway requires either an Intel or AMD-64 processor.

## Ports, IPs, and Hostnames Allowlist Requirements

For Flex Gateway to communicate with MuleSoft-managed online Anypoint Platform APIs and services,
you must add these hostnames and ports of external resources to the allowlist:

<table><colgroup><col> <col> <col> <col> <col> <col></colgroup><thead><tr><th>Plane</th><th>Host</th><th>Port</th><th>Mode</th><th>Description</th><th>Protocol</th></tr></thead><tbody><tr><td><p><strong>US</strong></p></td><td><p><strong>anypoint.mulesoft.com</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to connect with the control plane, push internal metrics, and download custom policy binaries.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>US</strong></p></td><td><p><strong>arm-mcm2-service.kprod.msap.io</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to communicate with the transport layer.</p></td><td><p>mTLS</p></td></tr><tr><td><p><strong>US</strong></p></td><td><p><strong>logging.ingestion.us-east-1.prod.cloudhub.io</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to send analytics data to the control plane.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>US</strong></p></td><td><p><strong>metering.ingestion.us-east-1.prod.cloudhub.io</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to send analytics data to the control plane.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>US</strong></p></td><td><p><strong>monitoring.ingestion.us-east-1.prod.cloudhub.io</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to send analytics data to the control plane.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>US</strong></p></td><td><p><strong>exchange-files.anypoint.mulesoft.com</strong></p></td><td><p>443</p></td><td><p>Connected</p></td><td><p>Required to download policies.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>US</strong></p></td><td><p><strong>exchange2-asset-manager-kprod.s3.amazonaws.com</strong></p></td><td><p>443</p></td><td><p>Connected</p></td><td><p>Required to download policies.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>US</strong></p></td><td><p><strong>configuration-resolver.prod.cloudhub.io</strong></p></td><td><p>443</p></td><td><p>Connected</p></td><td><p>Required to download policies.</p></td><td><p>mTLS</p></td></tr><tr><td><p><strong>US</strong></p></td><td><p><strong>us1.ingest.mulesoft.com</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to send analytics data to the control plane.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>US</strong></p></td><td><p><strong>flex-packages.anypoint.mulesoft.com</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to download and install Flex Gateway.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>eu1.anypoint.mulesoft.com</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to connect with the control plane, push internal metrics, and download custom policy binaries.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>arm-mcm2-service.kprod-eu.msap.io</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to communicate with the transport layer.</p></td><td><p>mTLS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>logging.ingestion.eu-central-1.prod-eu.msap.io</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to send analytics data to the control plane.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>metering.ingestion.eu-central-1.prod-eu.msap.io</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to send analytics data to the control plane.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>eu1.ingest.mulesoft.com</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to send analytics data to the control plane.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>monitoring.ingestion.eu-central-1.prod-eu.msap.io</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to send analytics data to the control plane.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>configuration-resolver.prod-eu.msap.io</strong></p></td><td><p>443</p></td><td><p>Connected</p></td><td><p>Required to download policies.</p></td><td><p>mTLS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>exchange-files.eu1.anypoint.mulesoft.com</strong></p></td><td><p>443</p></td><td><p>Connected</p></td><td><p>Required to download policies.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>exchange2-asset-manager-kprod-eu.s3.eu-central-1.amazonaws.com</strong></p></td><td><p>443</p></td><td><p>Connected</p></td><td><p>Required to download policies.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>flex-packages.anypoint.mulesoft.com</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to download and install Flex Gateway.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>flex-packages.eu1.anypoint.mulesoft.com</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to download and install Flex Gateway.</p></td><td><p>HTTPS</p></td></tr></tbody></table>

To establish connection for these endpoints, you must configure SSL passthrough:

- arm-mcm2-service.kprod.msap.io

- logging.ingestion.us-east-1.prod.cloudhub.io

- metering.ingestion.us-east-1.prod.cloudhub.io

- monitoring.ingestion.us-east-1.prod.cloudhub.io

- configuration-resolver.prod.cloudhub.io

- us1.ingest.mulesoft.com

- arm-mcm2-service.kprod-eu.msap.io

- logging.ingestion.eu-central-1.prod-eu.msap.io

- metering.ingestion.eu-central-1.prod-eu.msap.io

- eu1.ingest.mulesoft.com

- monitoring.ingestion.eu-central-1.prod-eu.msap.io

- configuration-resolver.prod-eu.msap.io

> [!NOTE] Ports 9998 and 9999 are reserved for internal processes and shouldn’t be used in
> `ApiInstance` definitions.

## Flex Gateway Limits and Performance Metrics

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Limit</th><th>Value</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Request header</p></div></div></td><td><div><div><p>60 KB</p></div></div></td><td><div><div><p>Requests that exceed this limit receive a <code>431</code> response.</p></div></div></td></tr><tr><td><div><div><p>Payload</p></div></div></td><td><div><div><p>1 MB</p></div></div></td><td><div><div><p>This limit applies only to buffering the payload (such as logging the payload using message logging). If you’re not accessing the payload, the payload size has no limit.<br>Payloads that exceed this limit receive a 413 response.</p></div></div></td></tr><tr><td><div><div><p>Contracts per API</p></div></div></td><td><div><div><p>1,000</p></div></div></td><td><div><div><p>Exceeding this limit isn’t supported but doesn’t cause errors.</p></div></div></td></tr><tr><td><div><div><p>Contracts per gateway instance</p></div></div></td><td><div><div><p>10,000</p></div></div></td><td><div><div><p>Exceeding this limit isn’t supported but doesn’t cause errors.</p></div></div></td></tr><tr><td><div><div><p>Upstreams per API</p></div></div></td><td><div><div><p>100</p></div></div></td><td><div><div><p>The 100 upstreams can consist of a combination of different routes.<br>To learn more, see <a href="https://docs.mulesoft.com/api-manager/latest/create-instance-task-flex#limits">Multiple Upstream Limits</a>.</p></div></div></td></tr><tr><td><div><div><p>Routes per API</p></div></div></td><td><div><div><p>100</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Upstreams per route</p></div></div></td><td><div><div><p>10</p></div></div></td><td><div></div></td></tr></tbody></table>

### Managed Flex Gateway Limits and Performance Metrics

Each Managed Flex Gateway size has a limit on the number of APIs it can deploy. The platform doesn’t
allow you to exceed this limit.

<table><colgroup><col> <col></colgroup><thead><tr><th>Gateway Size</th><th>API Limit</th></tr></thead><tbody><tr><td><div><div><p>Extra Large Managed Gateway</p></div></div></td><td><div><div><p>500</p></div></div></td></tr><tr><td><div><div><p>Large Managed Gateway</p></div></div></td><td><div><div><p>500</p></div></div></td></tr><tr><td><div><div><p>Small Managed Gateway</p></div></div></td><td><div><div><p>50</p></div></div></td></tr></tbody></table>

Each Managed Flex Gateway size supports a maximum number of transactions per second (TPS). Exceeding
this number can increase request latency.

<table><colgroup><col> <col></colgroup><thead><tr><th>Gateway Size</th><th>TPS</th></tr></thead><tbody><tr><td><div><div><p>Extra Large Managed Gateway</p></div></div></td><td><div><div><p>4000</p></div></div></td></tr><tr><td><div><div><p>Large Managed Gateway</p></div></div></td><td><div><div><p>1500</p></div></div></td></tr><tr><td><div><div><p>Small Managed Gateway</p></div></div></td><td><div><div><p>50</p></div></div></td></tr></tbody></table>

### Self-Managed Flex Gateway Limits and Performance Metrics

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Limit</th><th>Value</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Request header</p></div></div></td><td><div><div><p>60 KB</p></div></div></td><td><div><div><p>Requests that exceed this limit receive a <code>431</code> response.</p></div></div></td></tr><tr><td><div><div><p>APIs per Self-Managed Gateway instance</p></div></div></td><td><div><div><p>1,000</p></div></div></td><td><div><div><p>Exceeding this limit isn’t supported but doesn’t cause errors.</p></div></div></td></tr></tbody></table>

### See also

- [Configuring Timeouts in Connected Mode](https://docs.mulesoft.com/gateway/1.12/flex-conn-timeout)

- [Configuring Timeouts in Local Mode](https://docs.mulesoft.com/gateway/1.12/flex-local-timeout)