---
schema_version: "1"
id: 6075e6084ff3c267d3139b0f198e8707078182e0a0b2380c138304c9666349dc
title: Configuring Your Network to Support Runtime Fabric
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/runtime-fabric/latest/install-self-managed-network-configuration.md
canonical_url: https://docs.mulesoft.com/runtime-fabric/latest/install-self-managed-network-configuration
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 4e0e6d1ac389cbd7a08b3208667a490b5f66d8b8c099b5f69d904e12b0f3eb44
description: MuleSoft Documentation Site
release: "3.0"
latest: true
---
---
product: Runtime Fabric
version: 3.0
is-latest-version: true
---

# Configuring Your Network to Support Runtime Fabric

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

> [!IMPORTANT] Network configuration must be performed by an IT administrator.

Before installing or using Runtime Fabric, ensure that the following ports and hostnames are
configured correctly. Note that all internal communication within the cluster (between pods and
services) needs to be allowed.

## Port Configuration

To install or run Runtime Fabric, ensure that you have configured the following ports on your
Kubernetes installation.

For protocol-aware firewalls, consider allowing the following port traffic to use AMQP (Advanced
Message Queuing Protocol) over Websockets.

> [!NOTE] The following table does not include ports and hostnames from Anypoint Platform that you
> may also need to allow. Refer to
> [the Anypoint Mule Gateway documentation](https://docs.mulesoft.com/mule-gateway/mule-gateway-hostnames) for a list of
> additional ports and hostnames.

<table><colgroup><col> <col> <col> <col> <col> <col></colgroup><thead><tr><th>Port</th><th>Layer 4 Protocol</th><th>Layer 7 Protocol</th><th>Source</th><th>Destination</th><th>Description</th></tr></thead><tbody><tr><td><p>443</p></td><td><p>TCP</p></td><td><p>HTTPS</p></td><td><p>API consumers</p></td><td><p>All nodes</p></td><td><p>Allow inbound API requests to ingress controllers</p></td></tr><tr><td><p>443</p></td><td><p>TCP</p></td><td><p>AMQP over WebSockets</p></td><td><p>All nodes</p></td><td><p>Internet</p></td><td><p>Anypoint Platform management services</p></td></tr><tr><td><p>443</p></td><td><p>TCP</p></td><td><p>HTTPS</p></td><td><p>All nodes</p></td><td><p>Internet</p></td><td><p>API Manager policy updates, API Analytics Ingestion, and Resource retrieval (application files, container images).</p></td></tr><tr><td><p>443 (v1.8.50, or later)</p></td><td><p>TCP</p></td><td><p>HTTPS</p></td><td><p>All nodes</p></td><td><p>Internet</p></td><td><p>Anypoint Monitoring, Anypoint Visualizer</p></td></tr></tbody></table>

## Port Used by the Persistence Gateway

The Persistent Gateway requires a Postgres-compliant database to store persistent data across Mule
application replicas. Ensure that your Kubernetes cluster has access to this database and port. See
[Persistence Gateway](https://docs.mulesoft.com/runtime-fabric/latest/persistence-gateway).

## Hostname Endpoint Configuration

To function correctly, Runtime Fabric requires the following hostname endpoint configurations. Give
access to these endpoints in your infrastructure to avoid any installation or deployment issues.

### US Cloud

This table lists the required hostname endpoint configurations for the US Cloud.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Port</th><th>Protocol</th><th>Hostnames</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>AMQP over WebSockets</p></div></div></td><td><div><div><p><code>transport-layer.prod.cloudhub.io</code></p></div></div></td><td><div><div><p>Runtime Fabric message broker for interaction with the control plane.</p></div></div></td></tr><tr><td><div><div><p>443 (v2.6.22 and later)</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>us1.ingest.mulesoft.com</code></p></div></div></td><td><div><div><p><a href="https://docs.mulesoft.com/runtime-fabric/latest/use-anypoint-monitoring#enable-anypoint-monitoring">Anypoint Monitoring</a> agent for Runtime Fabric.</p></div></div></td></tr><tr><td><div><div><p>443 (pre-2.6.22, legacy)</p></div></div></td><td><div><div><p>TCP (Lumberjack)</p></div></div></td><td><div><div><p><code>dias-ingestor-router.us-east-1.prod.cloudhub.io</code></p></div></div></td><td><div><div><p><a href="https://docs.mulesoft.com/runtime-fabric/latest/use-anypoint-monitoring#enable-anypoint-monitoring">Anypoint Monitoring</a> agent for Runtime Fabric.</p></div><div><p><strong>Required only for Runtime Fabric versions earlier than 2.6.22. After upgrading to Runtime Fabric 2.6.22 or later and redeploying all applications, this endpoint is no longer used.</strong></p></div></div></td></tr><tr><td><div><div><p>5044 (legacy)</p></div></div></td><td><div><div><p>TCP (Lumberjack)</p></div></div></td><td><div><div><p><code>dias-ingestor-nginx.prod.cloudhub.io</code></p></div></div></td><td><div><div><p><a href="https://docs.mulesoft.com/runtime-fabric/latest/use-anypoint-monitoring#enable-anypoint-monitoring">Anypoint Monitoring</a> agent for Runtime Fabric.</p></div><div><p><strong>Starting with Runtime Fabric version 1.8.50, this port is not required. It will be deprecated in the future.</strong></p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>anypoint.mulesoft.com</code></p></div></div></td><td><div><div><p>Anypoint Platform for pulling assets.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>worker-cloud-helm-prod.s3.amazonaws.com</code></p></div></div></td><td><div><div><p>Runtime Fabric version repository. The Runtime Fabric installation uses software from this repository during installation and upgrades.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>exchange2-asset-manager-kprod.s3.amazonaws.com</code></p></div></div></td><td><div><div><p>Anypoint Exchange for application assets.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>exchange-files.anypoint.mulesoft.com</code></p></div></div></td><td><div><div><p>Anypoint Exchange for application files.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>rtf-runtime-registry.kprod.msap.io</code></p></div></div></td><td><div><div><p>Runtime Fabric Docker repository.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>prod-us-east-1-starport-layer-bucket.s3.amazonaws.com</code>, <code>prod-us-east-1-starport-layer-bucket.s3.us-east-1.amazonaws.com</code></p></div></div></td><td><div><div><p>Runtime Fabric Docker image delivery.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>esvc-us-east-1-sfcd-ms-fabric.s3.amazonaws.com</code></p></div></div></td><td><div><div><p>Runtime Fabric agent and installer downloads. Download endpoints redirect clients to this bucket.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>runtime-fabric.s3.amazonaws.com</code></p></div></div></td><td><div><div><p>Older Runtime Fabric agent versions, and installer and <code>rtfctl</code> artifacts.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>configuration-resolver.prod.cloudhub.io</code></p></div></div></td><td><div><div><p>Anypoint Configuration Resolver.</p></div></div></td></tr></tbody></table>

### EU Cloud

This table lists the required hostname endpoint configurations for the EU Cloud.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Port</th><th>Protocol</th><th>Hostnames</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>AMQP over WebSockets</p></div></div></td><td><div><div><p><code>transport-layer.prod-eu.msap.io</code></p></div></div></td><td><div><div><p>Runtime Fabric message broker for interaction with the control plane.</p></div></div></td></tr><tr><td><div><div><p>443 (v2.6.22 and later)</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>eu1.ingest.mulesoft.com</code></p></div></div></td><td><div><div><p><a href="https://docs.mulesoft.com/runtime-fabric/latest/use-anypoint-monitoring#enable-anypoint-monitoring">Anypoint Monitoring</a> agent for Runtime Fabric.</p></div></div></td></tr><tr><td><div><div><p>443 (pre-2.6.22, legacy)</p></div></div></td><td><div><div><p>TCP (Lumberjack)</p></div></div></td><td><div><div><p><code>dias-ingestor-router.eu-central-1.prod-eu.msap.io</code></p></div></div></td><td><div><div><p><a href="https://docs.mulesoft.com/runtime-fabric/latest/use-anypoint-monitoring#enable-anypoint-monitoring">Anypoint Monitoring</a> agent for Runtime Fabric.</p></div><div><p><strong>Required only for Runtime Fabric versions earlier than 2.6.22. After upgrading to Runtime Fabric 2.6.22 or later and redeploying all applications, this endpoint is no longer used.</strong></p></div></div></td></tr><tr><td><div><div><p>5044 (legacy)</p></div></div></td><td><div><div><p>TCP (Lumberjack)</p></div></div></td><td><div><div><p><code>dias-ingestor-nginx.prod-eu.msap.io</code></p></div></div></td><td><div><div><p><a href="https://docs.mulesoft.com/runtime-fabric/latest/use-anypoint-monitoring#enable-anypoint-monitoring">Anypoint Monitoring</a> agent for Runtime Fabric.</p></div><div><p><strong>Starting with Runtime Fabric version 1.8.50, this port is not required. It will be deprecated in the future.</strong></p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>eu1.anypoint.mulesoft.com</code></p></div></div></td><td><div><div><p>Anypoint Platform for pulling assets.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>worker-cloud-helm-prod-eu-rt.s3.amazonaws.com</code>, <code>worker-cloud-helm-prod-eu-rt.s3.eu-central-1.amazonaws.com</code></p></div></div></td><td><div><div><p>Runtime Fabric version repository. The Runtime Fabric installation uses software from this repository during installation and upgrades.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>exchange2-asset-manager-kprod-eu.s3.amazonaws.com</code>, <code>exchange2-asset-manager-kprod-eu.s3.eu-central-1.amazonaws.com</code></p></div></div></td><td><div><div><p>Anypoint Exchange for application assets.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>exchange-files.eu1.anypoint.mulesoft.com</code></p></div></div></td><td><div><div><p>Anypoint Exchange for application files.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>rtf-runtime-registry.kprod-eu.msap.io</code></p></div></div></td><td><div><div><p>Runtime Fabric Docker repository.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>prod-eu-central-1-starport-layer-bucket.s3.amazonaws.com</code>, <code>prod-eu-central-1-starport-layer-bucket.s3.eu-central-1.amazonaws.com</code></p></div></div></td><td><div><div><p>Runtime Fabric Docker image delivery.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>esvc-eu-central-1-sfcd-ms-fabric.s3.eu-central-1.amazonaws.com</code></p></div></div></td><td><div><div><p>Runtime Fabric agent and installer downloads. Download endpoints redirect clients to this bucket.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>runtime-fabric-eu.s3.amazonaws.com</code>, <code>runtime-fabric-eu.s3.eu-central-1.amazonaws.com</code></p></div></div></td><td><div><div><p>Older Runtime Fabric agent versions, and installer and <code>rtfctl</code> artifacts.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>configuration-resolver.prod-eu.msap.io</code></p></div></div></td><td><div><div><p>Anypoint Configuration Resolver.</p></div></div></td></tr></tbody></table>

### Canada Cloud

This table lists the required hostname endpoint configurations for the Canada Cloud.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Port</th><th>Protocol</th><th>Hostnames</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>11443</p></div></div></td><td><div><div><p>WSS</p></div></div></td><td><div><div><p><code>arm-mcm2-service-mulesoft-cp.sfdc-58ktaz.svc.sfdcfc.net</code></p></div></div></td><td><div><div><p>Runtime Fabric message broker for interaction with the control plane.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>ca1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>Anypoint Platform for agent bootstrapping and certificate renewal.</p></div></div></td></tr><tr><td><div><div><p>8443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>runtime-manager.ca1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>Configuration Resolver, Exchange asset download, and Runtime Manager services. In the Canada control plane, these services are consolidated behind a single endpoint.</p></div></div></td></tr><tr><td><div><div><p>8443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>ingest.ca1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p><a href="https://docs.mulesoft.com/runtime-fabric/latest/use-anypoint-monitoring#enable-anypoint-monitoring">Anypoint Monitoring</a> agent for Runtime Fabric (logs, metrics, and traces ingestion via OTEL).</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>rtf-runtime-registry-mulesoft-cp.sfdc-58ktaz.svc.sfdcfc.net</code></p></div></div></td><td><div><div><p>Runtime Fabric Docker and Helm chart repository. All container images (Mule runtime, monitoring sidecars, and Runtime Fabric agent) are pulled from this registry.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>esvc-ca-central-1-sfcd-ms-fabric.s3.ca-central-1.amazonaws.com</code></p></div></div></td><td><div><div><p>Runtime Fabric agent and installer downloads. Download endpoints redirect clients to this bucket.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>esvc-us-east-2-mulesoft.s3.us-east-2.amazonaws.com</code></p></div></div></td><td><div><div><p>Older Runtime Fabric agent versions, and installer and <code>rtfctl</code> artifacts.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>prod-us-east-1-starport-layer-bucket.s3.us-east-1.amazonaws.com</code></p></div></div></td><td><div><div><p>Runtime Fabric Docker image delivery.</p></div></div></td></tr></tbody></table>

### Japan Cloud

This table lists the required hostname endpoint configurations for the Japan Cloud.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Port</th><th>Protocol</th><th>Hostnames</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>11443</p></div></div></td><td><div><div><p>WSS</p></div></div></td><td><div><div><p><code>arm-mcm2-service-mulesoft-cp.sfdc-mchho0.svc.sfdcfc.net</code></p></div></div></td><td><div><div><p>Runtime Fabric message broker for interaction with the control plane.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>jp1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>Anypoint Platform for agent bootstrapping and certificate renewal.</p></div></div></td></tr><tr><td><div><div><p>8443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>runtime-manager.jp1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>Configuration Resolver, Exchange asset download, and Runtime Manager services. In the Japan Cloud, these services are consolidated behind a single endpoint.</p></div></div></td></tr><tr><td><div><div><p>8443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>ingest.jp1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p><a href="https://docs.mulesoft.com/runtime-fabric/latest/use-anypoint-monitoring#enable-anypoint-monitoring">Anypoint Monitoring</a> agent for Runtime Fabric (logs, metrics, and traces ingestion via OTEL).</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>rtf-runtime-registry-mulesoft-cp.sfdc-mchho0.svc.sfdcfc.net</code></p></div></div></td><td><div><div><p>Runtime Fabric Docker and Helm chart repository. All container images (Mule runtime, monitoring sidecars, and Runtime Fabric agent) are pulled from this registry.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>esvc-ap-northeast-1-sfcd-ms-fabric.s3.ap-northeast-1.amazonaws.com</code></p></div></div></td><td><div><div><p>Runtime Fabric agent and installer downloads. Download endpoints redirect clients to this bucket.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>esvc-us-east-2-mulesoft.s3.us-east-2.amazonaws.com</code></p></div></div></td><td><div><div><p>Older Runtime Fabric agent versions, and installer and <code>rtfctl</code> artifacts.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>prod-us-east-1-starport-layer-bucket.s3.us-east-1.amazonaws.com</code></p></div></div></td><td><div><div><p>Runtime Fabric Docker image delivery.</p></div></div></td></tr></tbody></table>

### India Cloud

This table lists the required hostname endpoint configurations for the India Cloud.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Port</th><th>Protocol</th><th>Hostnames</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>8443</p></div></div></td><td><div><div><p>WSS</p></div></div></td><td><div><div><p><code>runtime-manager.in1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>Runtime Fabric message broker for interaction with the control plane (path: <code>/v1/connect</code>).</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>in1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>Anypoint Platform for agent bootstrapping and certificate renewal.</p></div></div></td></tr><tr><td><div><div><p>8443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>runtime-manager.in1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>Configuration Resolver, Exchange asset download, and Runtime Manager services. In the India Cloud, these services are consolidated behind a single endpoint (path: <code>/resolver</code>).</p></div></div></td></tr><tr><td><div><div><p>8443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>ingest.in1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p><a href="https://docs.mulesoft.com/runtime-fabric/latest/use-anypoint-monitoring#enable-anypoint-monitoring">Anypoint Monitoring</a> agent for Runtime Fabric (logs, metrics, and traces ingestion via OTEL).</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>rtf-runtime-registry-mulesoft-cp.sfdc-y37hzm.svc.sfdcfc.net</code></p></div></div></td><td><div><div><p>Runtime Fabric Docker and Helm chart repository. All container images (Mule runtime, monitoring sidecars, and Runtime Fabric agent) are pulled from this registry.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>esvc-ap-south-1-sfcd-ms-fabric.s3.ap-south-1.amazonaws.com</code></p></div></div></td><td><div><div><p>Runtime Fabric agent and installer downloads. Download endpoints redirect clients to this bucket.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>esvc-us-east-2-mulesoft.s3.us-east-2.amazonaws.com</code></p></div></div></td><td><div><div><p>Older Runtime Fabric agent versions, and installer and <code>rtfctl</code> artifacts.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>prod-us-east-1-starport-layer-bucket.s3.us-east-1.amazonaws.com</code></p></div></div></td><td><div><div><p>Runtime Fabric Docker image delivery.</p></div></div></td></tr></tbody></table>

### Australia Cloud

This table lists the required hostname endpoint configurations for the Australia Cloud.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Port</th><th>Protocol</th><th>Hostnames</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>8443</p></div></div></td><td><div><div><p>WSS</p></div></div></td><td><div><div><p><code>runtime-manager.au1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>Runtime Fabric message broker for interaction with the control plane (path: <code>/v1/connect</code>).</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>au1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>Anypoint Platform for agent bootstrapping and certificate renewal.</p></div></div></td></tr><tr><td><div><div><p>8443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>runtime-manager.au1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>Configuration Resolver, Exchange asset download, and Runtime Manager services. In the Australia Cloud, these services are consolidated behind a single endpoint (path: <code>/resolver</code>).</p></div></div></td></tr><tr><td><div><div><p>8443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>ingest.au1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p><a href="https://docs.mulesoft.com/runtime-fabric/latest/use-anypoint-monitoring#enable-anypoint-monitoring">Anypoint Monitoring</a> agent for Runtime Fabric (logs, metrics, and traces ingestion via OTEL).</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>rtf-runtime-registry-mulesoft-cp.sfdc-vwfla6.svc.sfdcfc.net</code></p></div></div></td><td><div><div><p>Runtime Fabric Docker and Helm chart repository. All container images (Mule runtime, monitoring sidecars, and Runtime Fabric agent) are pulled from this registry.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>esvc-ap-southeast-2-sfcd-ms-fabric.s3.ap-southeast-2.amazonaws.com</code></p></div></div></td><td><div><div><p>Runtime Fabric agent and installer downloads. Download endpoints redirect clients to this bucket.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>esvc-us-east-2-mulesoft.s3.us-east-2.amazonaws.com</code></p></div></div></td><td><div><div><p>Older Runtime Fabric agent versions, and installer and <code>rtfctl</code> artifacts.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>prod-us-east-1-starport-layer-bucket.s3.us-east-1.amazonaws.com</code></p></div></div></td><td><div><div><p>Runtime Fabric Docker image delivery.</p></div></div></td></tr></tbody></table>

### United Kingdom Cloud

This table lists the required hostname endpoint configurations for the United Kingdom Cloud.

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Port</th><th>Protocol</th><th>Hostnames</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>8443</p></div></div></td><td><div><div><p>WSS</p></div></div></td><td><div><div><p><code>runtime-manager.gb1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>Runtime Fabric message broker for interaction with the control plane (path: <code>/v1/connect</code>).</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>gb1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>Anypoint Platform for agent bootstrapping and certificate renewal.</p></div></div></td></tr><tr><td><div><div><p>8443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>runtime-manager.gb1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>Configuration Resolver, Exchange asset download, and Runtime Manager services. In the United Kingdom Cloud, these services are consolidated behind a single endpoint (path: <code>/resolver</code>).</p></div></div></td></tr><tr><td><div><div><p>8443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>ingest.gb1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p><a href="https://docs.mulesoft.com/runtime-fabric/latest/use-anypoint-monitoring#enable-anypoint-monitoring">Anypoint Monitoring</a> agent for Runtime Fabric (logs, metrics, and traces ingestion via OTEL).</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>rtf-runtime-registry-mulesoft-cp.sfdc-5pakla.svc.sfdcfc.net</code></p></div></div></td><td><div><div><p>Runtime Fabric Docker and Helm chart repository. All container images (Mule runtime, monitoring sidecars, and Runtime Fabric agent) are pulled from this registry.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>esvc-eu-west-2-sfcd-ms-fabric.s3.eu-west-2.amazonaws.com</code></p></div></div></td><td><div><div><p>Runtime Fabric agent and installer downloads. Download endpoints redirect clients to this bucket.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>esvc-us-east-2-mulesoft.s3.us-east-2.amazonaws.com</code></p></div></div></td><td><div><div><p>Older Runtime Fabric agent versions, and installer and <code>rtfctl</code> artifacts.</p></div></div></td></tr><tr><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p><code>prod-us-east-1-starport-layer-bucket.s3.us-east-1.amazonaws.com</code></p></div></div></td><td><div><div><p>Runtime Fabric Docker image delivery.</p></div></div></td></tr></tbody></table>

## Verify Outbound Connectivity

Every Anypoint Runtime Fabric cluster requires connectivity with Anypoint control plane, and any
interference with connectivity can limit functionality, resulting in application deployment failures
or degraded status in Anypoint Runtime Manager.

You can use `rtfctl` to verify that Runtime Fabric has the required outbound connectivity. On each
node, follow the instructions in [Install rtfctl](https://docs.mulesoft.com/runtime-fabric/latest/install-rtfctl) to install `rtfctl`.

To verify the required outbound connectivity, run the following command on all controller and worker
nodes in the cluster:

./rtfctl test outbound-network

Sample output:

\[root@rtf-controller-1 runtimefabric\]# ./rtfctl test outbound-network Using proxy configuration
from Runtime Fabric (proxy "", no proxy "")

Using 'US' region transport-layer.prod.cloudhub.io:443 ✔ https://anypoint.mulesoft.com ✔
https://worker-cloud-helm-prod.s3.amazonaws.com ✔
https://exchange2-asset-manager-kprod.s3.amazonaws.com ✔ https://ecr.us-east-1.amazonaws.com ✔
https://494141260463.dkr.ecr.us-east-1.amazonaws.com ✔
https://prod-us-east-1-starport-layer-bucket.s3.amazonaws.com ✔
https://runtime-fabric.s3.amazonaws.com ✔ tcp://dias-ingestor-nginx.prod.cloudhub.io:443 ✔

If you have outbound connectivity issues that prevent Runtime Fabric from reaching any of the
required Anypoint control plane services, work with your network team to verify that you have added
the required port IPs and hostnames to the allowlist as described in the port configuration section.

## Certificate Configuration

To allow different endpoints to use mutual TLS authentication to establish a connection, you must
configure SSL passthrough to allow the following certificates:

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Cloud</th><th>Hostname</th><th>Port</th><th>Protocol</th><th>Purpose</th></tr></thead><tbody><tr><td><div><div><p>US Cloud</p></div></div></td><td><div><div><p><code>transport-layer.prod.cloudhub.io</code></p></div></div></td><td><div><div><p>443</p></div></div></td><td><div><div><p>AMQP over WebSockets</p></div></div></td><td><div><div><p>Message broker (mTLS)</p></div></div></td></tr><tr><td><div><div><p>US Cloud</p></div></div></td><td><div><div><p><code>configuration-resolver.prod.cloudhub.io</code></p></div></div></td><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p>Configuration Resolver</p></div></div></td></tr><tr><td><div><div><p>US Cloud</p></div></div></td><td><div><div><p><code>us1.ingest.mulesoft.com</code></p></div></div></td><td><div><div><p>443</p></div></div></td><td><div><div><p>TCP (Lumberjack)</p></div></div></td><td><div><div><p>Anypoint Monitoring ingest</p></div></div></td></tr><tr><td><div><div><p>EU Cloud</p></div></div></td><td><div><div><p><code>transport-layer.prod-eu.msap.io</code></p></div></div></td><td><div><div><p>443</p></div></div></td><td><div><div><p>AMQP over WebSockets</p></div></div></td><td><div><div><p>Message broker (mTLS)</p></div></div></td></tr><tr><td><div><div><p>EU Cloud</p></div></div></td><td><div><div><p><code>configuration-resolver.prod-eu.msap.io</code></p></div></div></td><td><div><div><p>443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p>Configuration Resolver</p></div></div></td></tr><tr><td><div><div><p>Canada Cloud</p></div></div></td><td><div><div><p><code>arm-mcm2-service-mulesoft-cp.sfdc-58ktaz.svc.sfdcfc.net</code></p></div></div></td><td><div><div><p>11443</p></div></div></td><td><div><div><p>WSS</p></div></div></td><td><div><div><p>Message broker (mTLS)</p></div></div></td></tr><tr><td><div><div><p>Canada Cloud</p></div></div></td><td><div><div><p><code>runtime-manager.ca1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>8443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p>Configuration Resolver and Runtime Manager services (consolidated endpoint)</p></div></div></td></tr><tr><td><div><div><p>Canada Cloud</p></div></div></td><td><div><div><p><code>ingest.ca1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>8443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p>Anypoint Monitoring ingest (OTEL)</p></div></div></td></tr><tr><td><div><div><p>Japan Cloud</p></div></div></td><td><div><div><p><code>arm-mcm2-service-mulesoft-cp.sfdc-mchho0.svc.sfdcfc.net</code></p></div></div></td><td><div><div><p>11443</p></div></div></td><td><div><div><p>WSS</p></div></div></td><td><div><div><p>Message broker (mTLS)</p></div></div></td></tr><tr><td><div><div><p>Japan Cloud</p></div></div></td><td><div><div><p><code>runtime-manager.jp1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>8443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p>Configuration Resolver and Runtime Manager services (consolidated endpoint)</p></div></div></td></tr><tr><td><div><div><p>Japan Cloud</p></div></div></td><td><div><div><p><code>ingest.jp1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>8443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p>Anypoint Monitoring ingest (OTEL)</p></div></div></td></tr><tr><td><div><div><p>India Cloud</p></div></div></td><td><div><div><p><code>runtime-manager.in1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>8443</p></div></div></td><td><div><div><p>WSS</p></div></div></td><td><div><div><p>Message broker (mTLS, path: <code>/v1/connect</code>)</p></div></div></td></tr><tr><td><div><div><p>India Cloud</p></div></div></td><td><div><div><p><code>runtime-manager.in1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>8443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p>Configuration Resolver and Runtime Manager services (consolidated endpoint, path: <code>/resolver</code>)</p></div></div></td></tr><tr><td><div><div><p>India Cloud</p></div></div></td><td><div><div><p><code>ingest.in1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>8443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p>Anypoint Monitoring ingest (OTEL)</p></div></div></td></tr><tr><td><div><div><p>Australia Cloud</p></div></div></td><td><div><div><p><code>runtime-manager.au1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>8443</p></div></div></td><td><div><div><p>WSS</p></div></div></td><td><div><div><p>Message broker (mTLS, path: <code>/v1/connect</code>)</p></div></div></td></tr><tr><td><div><div><p>Australia Cloud</p></div></div></td><td><div><div><p><code>runtime-manager.au1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>8443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p>Configuration Resolver and Runtime Manager services (consolidated endpoint, path: <code>/resolver</code>)</p></div></div></td></tr><tr><td><div><div><p>Australia Cloud</p></div></div></td><td><div><div><p><code>ingest.au1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>8443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p>Anypoint Monitoring ingest (OTEL)</p></div></div></td></tr><tr><td><div><div><p>United Kingdom Cloud</p></div></div></td><td><div><div><p><code>runtime-manager.gb1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>8443</p></div></div></td><td><div><div><p>WSS</p></div></div></td><td><div><div><p>Message broker (mTLS, path: <code>/v1/connect</code>)</p></div></div></td></tr><tr><td><div><div><p>United Kingdom Cloud</p></div></div></td><td><div><div><p><code>runtime-manager.gb1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>8443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p>Configuration Resolver and Runtime Manager services (consolidated endpoint, path: <code>/resolver</code>)</p></div></div></td></tr><tr><td><div><div><p>United Kingdom Cloud</p></div></div></td><td><div><div><p><code>ingest.gb1.platform.mulesoft.com</code></p></div></div></td><td><div><div><p>8443</p></div></div></td><td><div><div><p>HTTPS</p></div></div></td><td><div><div><p>Anypoint Monitoring ingest (OTEL)</p></div></div></td></tr></tbody></table>