---
schema_version: "1"
id: 020c37df9a83d99f7dd3c575720c230a2b142cbc9eae624ad41b827ff23cba88
title: Configuring Your Network to Support Runtime Fabric
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/runtime-fabric/2.11/install-self-managed-network-configuration.md
canonical_url: https://docs.mulesoft.com/runtime-fabric/2.11/install-self-managed-network-configuration
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 1b9a45cc113381e2dcef3ebc5a7806872cd3bca830c2d89a4034872a45d0fa5e
description: MuleSoft Documentation Site
release: "2.11"
latest: false
---
---
product: Runtime Fabric
version: 2.11
---

# Configuring Your Network to Support Runtime Fabric

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

> [!IMPORTANT] Network configuration must be performed by an IT administrator.

Before installing or using Runtime Fabric, ensure that these ports and hostnames are configured
correctly. Note that all internal communication within the cluster (between pods and services) needs
to be allowed.

## Port Configuration

To install or run Runtime Fabric, ensure that you have configured these ports on your Kubernetes
installation.

For protocol-aware firewalls, consider allowing this port traffic to use AMQP (Advanced Message
Queuing Protocol) over Websockets.

> [!NOTE] The following table does not include ports and hostnames from Anypoint Platform that you
> may also need to allow. Refer to
> [the Anypoint Mule Gateway documentation](https://docs.mulesoft.com/mule-gateway/mule-gateway-hostnames) for a list of
> additional ports and hostnames.

<table><colgroup><col> <col> <col> <col> <col> <col></colgroup><thead><tr><th>Port</th><th>Layer 4 Protocol</th><th>Layer 7 Protocol</th><th>Source</th><th>Destination</th><th>Description</th></tr></thead><tbody><tr><td><p>443</p></td><td><p>TCP</p></td><td><p>HTTPS</p></td><td><p>API consumers</p></td><td><p>All nodes</p></td><td><p>Allow inbound API requests to ingress controllers</p></td></tr><tr><td><p>443</p></td><td><p>TCP</p></td><td><p>AMQP over WebSockets</p></td><td><p>All nodes</p></td><td><p>Internet</p></td><td><p>Anypoint Platform management services</p></td></tr><tr><td><p>443</p></td><td><p>TCP</p></td><td><p>HTTPS</p></td><td><p>All nodes</p></td><td><p>Internet</p></td><td><p>API Manager policy updates, API Analytics Ingestion, and Resource retrieval (application files, container images).</p></td></tr><tr><td><p>443 (v1.8.50, or later)</p></td><td><p>TCP</p></td><td><p>Lumberjack</p></td><td><p>All nodes</p></td><td><p>Internet</p></td><td><p>Anypoint Monitoring, Anypoint Visualizer</p></td></tr></tbody></table>

## Port Used by the Persistence Gateway

The Persistent Gateway requires a Postgres-compliant database to store persistent data across Mule
application replicas. Ensure that your Kubernetes cluster has access to this database and port. See
[Persistence Gateway](https://docs.mulesoft.com/runtime-fabric/2.11/persistence-gateway).

## Hostname Endpoint Configuration

To function correctly, Runtime Fabric requires these hostname endpoint configurations. Give access
to these endpoints in your infrastructure to avoid any installation or deployment issues.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Port</th><th>Protocol</th><th>Hostnames</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>AMQP over WebSockets</p></div></div></td><td><div><div><ul><li><p>US control plane: <code>transport-layer.prod.cloudhub.io</code></p></li><li><p>EU control plane: <code>transport-layer.prod-eu.msap.io</code></p></li></ul></div></div></td><td><div><div><p>Runtime Fabric message broker for interaction with the control plane.</p></div></div></td></tr><tr><td><div><div><p>443 (v1.8.50 and later)</p></div></div></td><td><div><div><p>TCP (Lumberjack)</p></div></div></td><td><div><div><ul><li><p>US control plane:<br><code>dias-ingestor-router.us-east-1.prod.cloudhub.io</code><br><code>us1.ingest.mulesoft.com</code><br></p></li><li><p>EU control plane:<br><code>dias-ingestor-router.eu-central-1.prod-eu.msap.io</code><br><code>eu1.ingest.mulesoft.com</code><br></p></li></ul></div></div></td><td><div><div><p><a href="https://docs.mulesoft.com/runtime-fabric/2.11/use-anypoint-monitoring#enable-anypoint-monitoring">Anypoint Monitoring</a> agent for Runtime Fabric.</p></div></div></td></tr><tr><td><div><div><p>5044 (legacy)</p></div></div></td><td><div><div><p>TCP (Lumberjack)</p></div></div></td><td><div><div><ul><li><p>US control plane: <code>dias-ingestor-nginx.prod.cloudhub.io</code></p></li><li><p>EU control plane: <code>dias-ingestor-nginx.prod-eu.msap.io</code></p></li></ul></div></div></td><td><div><div><p><a href="https://docs.mulesoft.com/runtime-fabric/2.11/use-anypoint-monitoring#enable-anypoint-monitoring">Anypoint Monitoring</a> agent for Runtime Fabric.</p></div><div><p><strong>As of Runtime Fabric version 1.8.50, this port is not strictly required. It will be deprecated in the future.</strong></p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>anypoint.mulesoft.com</code></p></div></div></td><td><div><div><p>Anypoint Platform for pulling assets.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><ul><li><p>US control plane: <code>worker-cloud-helm-prod.s3.amazonaws.com</code></p></li><li><p>EU control plane: <code>worker-cloud-helm-prod-eu-rt.s3.amazonaws.com</code>, <code>worker-cloud-helm-prod-eu-rt.s3.eu-central-1.amazonaws.com</code></p></li></ul></div></div></td><td><div><div><p>Runtime Fabric version repository. The Runtime Fabric installation uses software from this repository during installation and upgrades.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><ul><li><p>US control plane: <code>exchange2-asset-manager-kprod.s3.amazonaws.com</code></p></li><li><p>EU control plane: <code>exchange2-asset-manager-kprod-eu.s3.amazonaws.com</code>, <code>exchange2-asset-manager-kprod-eu.s3.eu-central-1.amazonaws.com</code></p></li></ul></div></div></td><td><div><div><p>Anypoint Exchange for application assets.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><ul><li><p>US control plane: <code>exchange-files.anypoint.mulesoft.com</code></p></li><li><p>EU control plane: <code>exchange-files.eu1.anypoint.mulesoft.com</code></p></li></ul></div></div></td><td><div><div><p>Anypoint Exchange for application files.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><ul><li><p>US control plane: <code>rtf-runtime-registry.kprod.msap.io</code></p></li><li><p>EU control plane: <code>rtf-runtime-registry.kprod-eu.msap.io</code></p></li></ul></div></div></td><td><div><div><p>Runtime Fabric Docker repository.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><ul><li><p>US control plane: <code>prod-us-east-1-starport-layer-bucket.s3.amazonaws.com</code>, <code>prod-us-east-1-starport-layer-bucket.s3.us-east-1.amazonaws.com</code></p></li><li><p>EU control plane: <code>prod-eu-central-1-starport-layer-bucket.s3.amazonaws.com</code>, <code>prod-eu-central-1-starport-layer-bucket.s3.eu-central-1.amazonaws.com</code></p></li></ul></div></div></td><td><div><div><p>Runtime Fabric Docker image delivery.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><ul><li><p>US control plane: <code>runtime-fabric.s3.amazonaws.com</code></p></li><li><p>EU control plane: <code>runtime-fabric-eu.s3.amazonaws.com</code></p></li></ul></div></div></td><td><div><div><p>Runtime Fabric Docker repository.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><ul><li><p>US control plane: <code>configuration-resolver.prod.cloudhub.io</code></p></li><li><p>EU control plane: <code>configuration-resolver.prod-eu.msap.io</code></p></li></ul></div></div></td><td><div><div><p>Anypoint Configuration Resolver.</p></div></div></td></tr></tbody></table>

## Verify Outbound Connectivity

Every Anypoint Runtime Fabric cluster requires connectivity with Anypoint control plane, and any
interference with connectivity can limit functionality, resulting in application deployment failures
or degraded status in Anypoint Runtime Manager.

You can use `rtfctl` to verify that Runtime Fabric has the required outbound connectivity. On each
node, follow the instructions in [Install rtfctl](https://docs.mulesoft.com/runtime-fabric/2.11/install-rtfctl) to install `rtfctl`.

To verify the required outbound connectivity, run this command on all controller and worker nodes in
the cluster:

./rtfctl test outbound-network

Sample output:

\[root@rtf-controller-1 runtimefabric\]# ./rtfctl test outbound-network Using proxy configuration
from Runtime Fabric (proxy "", no proxy "")

Using 'US' region transport-layer.prod.cloudhub.io:443 ✔ https://anypoint.mulesoft.com ✔
https://worker-cloud-helm-prod.s3.amazonaws.com ✔
https://exchange2-asset-manager-kprod.s3.amazonaws.com ✔ https://ecr.us-east-1.amazonaws.com ✔
https://494141260463.dkr.ecr.us-east-1.amazonaws.com ✔
https://prod-us-east-1-starport-layer-bucket.s3.amazonaws.com ✔
https://runtime-fabric.s3.amazonaws.com ✔ tcp://dias-ingestor-nginx.prod.cloudhub.io:443 ✔

If you have outbound connectivity issues that prevent Runtime Fabric from reaching any of the
required Anypoint control plane services, work with your network team to verify that you have added
the required port IPs and hostnames to the allowlist as described in the port configuration section.

## Certificate Configuration

To allow different endpoints to use mutual TLS authentication to establish a connection, you must
configure SSL passthrough to allow these certificates:

<table><colgroup><col> <col></colgroup><thead><tr><th>Control Plane</th><th>Certificates</th></tr></thead><tbody><tr><td><div><div><p>US control plane</p></div></div></td><td><div><div><p><code>transport-layer.prod.cloudhub.io</code><br><code>configuration-resolver.prod.cloudhub.io</code><br><code>us1.ingest.mulesoft.com</code></p></div></div></td></tr><tr><td><div><div><p>EU control plane</p></div></div></td><td><div><div><p><code>transport-layer.prod-eu.msap.io</code><br><code>configuration-resolver.prod-eu.msap.io</code></p></div></div></td></tr></tbody></table>