---
schema_version: "1"
id: ef3c64a1a6fb3a513e06484d19b10d25067f7fb19df3ff4436fed504570ddb44
title: Requirements and Limits for Flex Gateway
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.9/flex-review-prerequisites.md
canonical_url: https://docs.mulesoft.com/gateway/1.9/flex-review-prerequisites
source_site: docs.mulesoft.com
content_type: documentation
content_hash: ab543c1d7909873b411b185c0809690f20b8fe858a8d2f418ef51ad3b0cecae3
description: MuleSoft Documentation Site
release: "1.9"
latest: false
---
---
product: Omni Gateway
version: 1.9
---

# Requirements and Limits for Flex Gateway

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Before you download and install Anypoint Flex Gateway, review the following requirements and limits.

## Flex Gateway Requirements

### Permission Requirements

To use Flex Gateway you must have these permissions:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Permission</th><th>Ability</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Manage Servers</p></div></div></td><td><div><div><p>Create, update, and delete server and Flex Gateway resources.</p></div></div></td><td><div><div><p>Runtime Manager permission, which is assigned to a specific environment in a Business Group.</p></div></div></td></tr><tr><td><div><div><p>Read Servers</p></div></div></td><td><div><div><p>View server and Flex Gateway resources.</p></div></div></td><td><div><div><p>Runtime Manager permission, which is assigned to a specific environment in a Business Group.</p></div></div></td></tr><tr><td><div><div><p>Usage Viewer</p></div></div></td><td><div><div><p>View gateway metrics.</p></div></div></td><td><div><div><p>Usage permission, which can be added only by an organization administrator at the root organization level.</p></div></div></td></tr></tbody></table>

Your Anypoint Platform Admin can add these permissions in Access Management. See
[Manage Team Permissions](https://docs.mulesoft.com/access-management/configure-teams#manage-team-permissions) for more
information.

### Connected App Scope Requirements

To register Self-Managed Flex Gateway using a Connected App, the following scopes are required:

- Manage Servers

- Read Servers

- View Organization

## Managed Flex Gateway Resource Requirements

To use Managed Flex Gateway your Business Group must have at least one of these Managed Flex Gateway
resources:

- Large Managed Flex Gateways

- Small Managed Flex Gateways

These resources aren’t inherited. To redistribute Managed Flex Gateway resources to a business
group, see
[Redistribute Resources Between Existing Business Groups](https://docs.mulesoft.com/access-management/business-groups#redistribute-resources).

## Managed Flex Gateway Private Space Requirement

To use Managed Flex Gateway, you have created a private space in CloudHub 2.0 or have access to a
private space created by someone else.

To create a private space, see [Creating Private Spaces](https://docs.mulesoft.com/cloudhub-2/ps-create-configure).

## Software Requirements for Self-Managed Flex Gateway

Flex Gateway isn’t supported on Windows or in Docker running on Windows.

### Software Requirements for Kubernetes and OpenShift Deployments

Running Flex Gateway requires:

- A minimum of either Kubernetes 1.21 or OpenShift 4.8.

- Ingress v1 (stable), which requires specifying `apiVersion: networking.k8s.io/v1` as the API
  version in your configuration resources.

- A private cloud or data center.

  Or, a cloud provider such as the following:

  - Google Kubernetes Engine (GKE)

  - Amazon Elastic Kubernetes Service (Amazon EKS)

  - Azure Kubernetes Service (AKS)

- A minimum Helm version of 3.0.0 is required.

### Software Requirements for Linux Deployments

Flex Gateway runs on the following Long Term Support (LTS) versions of Linux:

- Amazon Linux 2023

- CentOS 8

- Debian (Bullseye, Bookworm)

- Red Hat Enterprise Linux (9)

- Red Hat Enterprise Linux (9) on IBM Power (ppc64le)

- SUSE Linux Enterprise (SLES 15 SP3)

- SUSE Linux Enterprise (SLES 15 SP3) on IBM Power (ppc64le)

- Ubuntu (Focal, Jammy)

Flex Gateway is designed to run in cloud-native architectures. Therefore, multiple installations on
a single Linux VM aren’t supported. You can install only one gateway instance per Linux VM.

### Software Requirements for Container Deployments

Flex Gateway supports the following:

- Docker

- Podman

Additionally, Flex Gateway supports the following container orchestration services:

- Amazon Elastic Container Service (Amazon ECS)

- Azure Container Service (ACS)

- Google Cloud Run

- AWS Fargate

## Hardware Requirements for Self-Managed Flex Gateway

A single Flex Gateway can support multiple backend APIs. To support more backend APIs, you can
deploy multiple replicas or additional Flex Gateways. For information about sizing, refer to
[Resource Sizing for Self-Managed Flex Gateway](https://docs.mulesoft.com/gateway/1.9/flex-sizing-guide).

Flex Gateway requires either an Intel or AMD-64 processor.

## Ports, IPs, and Hostnames Allowlist Requirements

For Flex Gateway to communicate with MuleSoft-managed online Anypoint Platform APIs and services,
you must add these hostnames and ports of external resources to the allowlist:

<table><colgroup><col> <col> <col> <col> <col> <col></colgroup><thead><tr><th>Plane</th><th>Host</th><th>Port</th><th>Mode</th><th>Description</th><th>Protocol</th></tr></thead><tbody><tr><td><p><strong>US</strong></p></td><td><p><strong>anypoint.mulesoft.com</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to connect with the control plane, push internal metrics, and download custom policy binaries.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>US</strong></p></td><td><p><strong>arm-mcm2-service.kprod.msap.io</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to communicate with the transport layer.</p></td><td><p>mTLS</p></td></tr><tr><td><p><strong>US</strong></p></td><td><p><strong>logging.ingestion.us-east-1.prod.cloudhub.io</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to send analytics data to the control plane.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>US</strong></p></td><td><p><strong>metering.ingestion.us-east-1.prod.cloudhub.io</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to send analytics data to the control plane.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>US</strong></p></td><td><p><strong>monitoring.ingestion.us-east-1.prod.cloudhub.io</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to send analytics data to the control plane.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>US</strong></p></td><td><p><strong>exchange-files.anypoint.mulesoft.com</strong></p></td><td><p>443</p></td><td><p>Connected</p></td><td><p>Required to download policies.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>US</strong></p></td><td><p><strong>exchange2-asset-manager-kprod.s3.amazonaws.com</strong></p></td><td><p>443</p></td><td><p>Connected</p></td><td><p>Required to download policies.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>US</strong></p></td><td><p><strong>configuration-resolver.prod.cloudhub.io</strong></p></td><td><p>443</p></td><td><p>Connected</p></td><td><p>Required to download policies.</p></td><td><p>mTLS</p></td></tr><tr><td><p><strong>US</strong></p></td><td><p><strong>us1.ingest.mulesoft.com</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to send analytics data to the control plane.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>US</strong></p></td><td><p><strong>flex-packages.anypoint.mulesoft.com</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to download and install Flex Gateway.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>eu1.anypoint.mulesoft.com</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to connect with the control plane, push internal metrics, and download custom policy binaries.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>arm-mcm2-service.kprod-eu.msap.io</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to communicate with the transport layer.</p></td><td><p>mTLS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>logging.ingestion.eu-central-1.prod-eu.msap.io</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to send analytics data to the control plane.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>metering.ingestion.eu-central-1.prod-eu.msap.io</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to send analytics data to the control plane.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>eu1.ingest.mulesoft.com</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to send analytics data to the control plane.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>monitoring.ingestion.eu-central-1.prod-eu.msap.io</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to send analytics data to the control plane.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>configuration-resolver.prod-eu.msap.io</strong></p></td><td><p>443</p></td><td><p>Connected</p></td><td><p>Required to download policies.</p></td><td><p>mTLS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>exchange-files.eu1.anypoint.mulesoft.com</strong></p></td><td><p>443</p></td><td><p>Connected</p></td><td><p>Required to download policies.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>exchange2-asset-manager-kprod-eu.s3.eu-central-1.amazonaws.com</strong></p></td><td><p>443</p></td><td><p>Connected</p></td><td><p>Required to download policies.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>flex-packages.anypoint.mulesoft.com</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to download and install Flex Gateway.</p></td><td><p>HTTPS</p></td></tr><tr><td><p><strong>EU</strong></p></td><td><p><strong>flex-packages.eu1.anypoint.mulesoft.com</strong></p></td><td><p>443</p></td><td><p>Both</p></td><td><p>Required to download and install Flex Gateway.</p></td><td><p>HTTPS</p></td></tr></tbody></table>

To establish connection for these endpoints, you must configure SSL passthrough:

- arm-mcm2-service.kprod.msap.io

- logging.ingestion.us-east-1.prod.cloudhub.io

- metering.ingestion.us-east-1.prod.cloudhub.io

- monitoring.ingestion.us-east-1.prod.cloudhub.io

- configuration-resolver.prod.cloudhub.io

- us1.ingest.mulesoft.com

- arm-mcm2-service.kprod-eu.msap.io

- logging.ingestion.eu-central-1.prod-eu.msap.io

- metering.ingestion.eu-central-1.prod-eu.msap.io

- eu1.ingest.mulesoft.com

- monitoring.ingestion.eu-central-1.prod-eu.msap.io

- configuration-resolver.prod-eu.msap.io

> [!NOTE] Port 9998 is reserved for internal processes, and should not be used in `ApiInstance`
> definitions.

## Flex Gateway Limits

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Limit</th><th>Value</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Request header</p></div></div></td><td><div><div><p>60 KB</p></div></div></td><td><div><div><p>Requests that exceed this limit receive a <code>431</code> response.</p></div></div></td></tr><tr><td><div><div><p>Payload</p></div></div></td><td><div><div><p>1 MB</p></div></div></td><td><div><div><p>This limit applies only to buffering the payload (such as logging the payload using message logging). If you’re not accessing the payload, the payload size has no limit.<br>Payloads that exceed this limit receive a 413 response.</p></div></div></td></tr><tr><td><div><div><p>Contracts per API</p></div></div></td><td><div><div><p>1,000</p></div></div></td><td><div><div><p>Exceeding this limit isn’t supported but doesn’t cause errors.</p></div></div></td></tr><tr><td><div><div><p>Contracts per gateway instance</p></div></div></td><td><div><div><p>10,000</p></div></div></td><td><div><div><p>Exceeding this limit isn’t supported but doesn’t cause errors.</p></div></div></td></tr><tr><td><div><div><p>Upstreams per API</p></div></div></td><td><div><div><p>100</p></div></div></td><td><div><div><p>The 100 upstreams can consist of a combination of different routes.<br>To learn more, see <a href="https://docs.mulesoft.com/api-manager/latest/create-instance-task-flex#limits">Multiple Upstream Limits</a>.</p></div></div></td></tr><tr><td><div><div><p>Routes per API</p></div></div></td><td><div><div><p>100</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Upstreams per route</p></div></div></td><td><div><div><p>10</p></div></div></td><td><div></div></td></tr></tbody></table>

### Managed Flex Gateway Limits

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Limit</th><th>Value</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>APIs per Large Managed Gateway instance</p></div></div></td><td><div><div><p>500</p></div></div></td><td><div><div><p>Exceeding this limit isn’t supported but doesn’t cause errors.</p></div></div></td></tr><tr><td><div><div><p>APIs per Small Managed Gateway instance</p></div></div></td><td><div><div><p>50</p></div></div></td><td><div><div><p>Exceeding this limit isn’t supported but doesn’t cause errors.</p></div></div></td></tr><tr><td><div><div><p>Requests per second for Large Managed Gateway</p></div></div></td><td><div><div><p>500</p></div></div></td><td><div></div></td></tr><tr><td><div><div><p>Requests per second for Small Managed Gateway</p></div></div></td><td><div><div><p>100</p></div></div></td><td><div></div></td></tr></tbody></table>

### Self-Managed Flex Gateway Limits

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Limit</th><th>Value</th><th>Notes</th></tr></thead><tbody><tr><td><div><div><p>Request header</p></div></div></td><td><div><div><p>60 KB</p></div></div></td><td><div><div><p>Requests that exceed this limit receive a <code>431</code> response.</p></div></div></td></tr><tr><td><div><div><p>APIs per Self-Managed Gateway instance</p></div></div></td><td><div><div><p>1,000</p></div></div></td><td><div><div><p>Exceeding this limit isn’t supported but doesn’t cause errors.</p></div></div></td></tr></tbody></table>

## Flex Gateway Environment Variables

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Environment Variable</th><th>Default Value</th><th>Function</th></tr></thead><tbody><tr><td><div><div><p>FLEX_CONNECTION_IDLE_TIMEOUT_SECONDS</p></div></div></td><td><div><div><p>60</p></div></div></td><td><div><div><p>Maximum number of seconds a connection can be idle before it times out.</p></div></div></td></tr><tr><td><div><div><p>FLEX_DOWNSTREAM_CONNECTION_BUFFER_LIMIT_BYTES</p></div></div></td><td><div><div><p>1048576 (1 MB)</p></div></div></td><td><div><div><p>Maximum size, in bytes, of read and write buffers for new connections.</p></div></div></td></tr><tr><td><div><div><p>FLEX_ENVOY_HEADERS_ENABLED</p></div></div></td><td><div><div><p><code>false</code></p></div></div></td><td><div><div><p>Allows (<code>true</code>) or removes (<code>false</code>) Envoy headers from requests.</p></div></div></td></tr><tr><td><div><div><p>FLEX_STREAM_IDLE_TIMEOUT_SECONDS</p></div></div></td><td><div><div><p>300</p></div></div></td><td><div><div><p>Maximum number of seconds a stream can remain idle without receiving any data in either the inbound (client to Flex Gateway) or outbound (Flex Gateway to upstream service) direction.</p></div></div></td></tr><tr><td><div><div><p>FLEX_UPSTREAM_CONNECTION_IDLE_TIMEOUT_SECONDS</p></div></div></td><td><div><div><p>60</p></div></div></td><td><div><div><p>Maximum number of seconds a stream between Flex Gateway and the upstream service can remain idle between requests.</p></div></div></td></tr><tr><td><div><div><p>FLEX_UPSTREAM_RESPONSE_TIMEOUT_SECONDS</p></div></div></td><td><div><div><p>15</p></div></div></td><td><div><div><p>Maximum number of seconds a Flex Gateway waits for a response from an upstream service.</p></div></div></td></tr></tbody></table>

### See also

- [Configuring Timeouts in Connected Mode](https://docs.mulesoft.com/gateway/1.9/flex-conn-timeout)

- [Configuring Timeouts in Local Mode](https://docs.mulesoft.com/gateway/1.9/flex-local-timeout)