---
schema_version: "1"
id: 812d53cc21a3960703fdb870cfb2ba7d0688535e99eabcf65a4a76bec7b3cfe1
title: Ports, IP Addresses, and Hostnames to Allow
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/runtime-manager/rtm-agent-allowlists.md
canonical_url: https://docs.mulesoft.com/runtime-manager/rtm-agent-allowlists
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 064eff22a0bad20c1f4b4f150cf2def49db2d76a99039c30f9a879a757cef6e9
description: MuleSoft Documentation Site
latest: true
---
---
product: Runtime Manager
keywords: agent, runtime manager, mule, esb, servers, monitor, notifications, external systems, third party, get status, metrics
---

# Ports, IP Addresses, and Hostnames to Allow

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

[![logo hybrid active](/mulesoft/current/en-us/_/img/icons/hybrid-cloud.svg "Hybrid")Hybrid](deployment-strategies#hybrid-deployments)[ ![logo server active](/mulesoft/current/en-us/_/img/icons/server-cloud.svg "Anypoint Platform PCE")Private Cloud Edition](deployment-strategies#anypoint-platform-private-cloud-edition)

In your network, you must add the hostnames and ports of various parts of Anypoint Platform to your
allowlist to enable the Runtime Manager agent in a customer-hosted Mule runtime engine to
communicate with the online Anypoint Platform APIs and services managed by MuleSoft.

## Endpoints

These endpoints use mutual TLS (mTLS) authentication:

- runtime-manager.anypoint.mulesoft.com

- runtime-manager.eu1.anypoint.mulesoft.com

- runtime-manager.gov.anypoint.mulesoft.com

- data-authenticator.anypoint.mulesoft.com

- data-authenticator.gov.anypoint.mulesoft.com

- us1.ingest.mulesoft.com

- eu1.ingest.mulesoft.com

> [!IMPORTANT] The `*.ingest.mulesoft.com:8443` endpoint uses Mutual TLS (mTLS) for direct
> agent-to-platform certificate authentication. Configure your firewall or network proxy to allow
> SSL passthrough — do not enable deep packet inspection (DPI) or SSL decryption for this traffic.
> Ensure proxy rules also permit outbound TCP on port 8443 in addition to standard port 443.

These endpoints use WebSockets:

- runtime-manager.anypoint.mulesoft.com

- runtime-manager.eu1.anypoint.mulesoft.com

- runtime-manager.gov.anypoint.mulesoft.com

> [!NOTE] Ports, IP addresses, and hostnames are required for outbound connectivity. Inbound
> connectivity is not required to your network and servers. The connection between customer-hosted
> Mule runtime and Anypoint Platform is established via persistent Websocket connections. All
> connections are outbound.

## Ports

> [!NOTE] Starting with Runtime Manager Agent 2.7.0 (Anypoint Monitoring Agent 2.7.1+), Mule
> runtimes stream telemetry metrics using an OpenTelemetry-based exporter. This requires outbound
> access to `*.ingest.mulesoft.com` on port 8443.

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Region</th><th>Name</th><th>Port</th></tr></thead><tbody><tr><td><div><div><p><strong>US</strong></p></div></div></td><td><div><div><p>anypoint.mulesoft.com</p></div></div></td><td><div><div><p>443</p></div></div></td></tr><tr><td><div><div><p><strong>US</strong></p></div></div></td><td><div><div><p>runtime-manager.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>443</p></div></div></td></tr><tr><td><div><div><p><strong>US</strong></p></div></div></td><td><div><div><p>analytics-ingest.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>443</p></div></div></td></tr><tr><td><div><div><p><strong>US</strong></p></div></div></td><td><div><div><p>data-authenticator.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>443</p></div></div></td></tr><tr><td><div><div><p><strong>US</strong></p></div></div></td><td><div><div><p>exchange-files.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>443</p></div></div></td></tr><tr><td><div><div><p><strong>US</strong></p></div></div></td><td><div><div><p>exchange2-asset-manager-kprod.s3.amazonaws.com</p></div></div></td><td><div><div><p>443</p></div></div></td></tr><tr><td><div><div><p><strong>US</strong></p></div></div></td><td><div><div><p>us1.ingest.mulesoft.com</p></div></div></td><td><div><div><p>8443</p></div></div></td></tr><tr><td><div><div><p><strong>US-GOV</strong></p></div></div></td><td><div><div><p>runtime-manager.gov.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>443</p></div></div></td></tr><tr><td><div><div><p><strong>US-GOV</strong></p></div></div></td><td><div><div><p>data-authenticator.gov.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>443</p></div></div></td></tr><tr><td><div><div><p><strong>US-GOV</strong></p></div></div></td><td><div><div><p>gov.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>443</p></div></div></td></tr><tr><td><div><div><p><strong>US-GOV</strong></p></div></div></td><td><div><div><p>exchange-files.gov.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>443</p></div></div></td></tr><tr><td><div><div><p><strong>US-GOV</strong></p></div></div></td><td><div><div><p>exchange2-asset-manager-kgprod.s3.us-gov-west-1.amazonaws.com</p></div></div></td><td><div><div><p>443</p></div></div></td></tr><tr><td><div><div><p><strong>EU</strong></p></div></div></td><td><div><div><p>eu1.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>443</p></div></div></td></tr><tr><td><div><div><p><strong>EU</strong></p></div></div></td><td><div><div><p>runtime-manager.eu1.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>443</p></div></div></td></tr><tr><td><div><div><p><strong>EU</strong></p></div></div></td><td><div><div><p>analytics-ingest.eu1.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>443</p></div></div></td></tr><tr><td><div><div><p><strong>EU</strong></p></div></div></td><td><div><div><p>data-authenticator.eu1.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>443</p></div></div></td></tr><tr><td><div><div><p><strong>EU</strong></p></div></div></td><td><div><div><p>exchange2-asset-manager-kprod-eu.s3.eu-central-1.amazonaws.com</p></div></div></td><td><div><div><p>443</p></div></div></td></tr><tr><td><div><div><p><strong>EU</strong></p></div></div></td><td><div><div><p>eu1.ingest.mulesoft.com</p></div></div></td><td><div><div><p>8443</p></div></div></td></tr></tbody></table>

## Static IP Addresses

> [!NOTE] As part of our continuous infrastructure improvement, MuleSoft introduces a new set of
> static IP addresses in Runtime Manager to augment existing ones. To avoid service disruption,
> allow the IP addresses or domains, depending on your network policy, through your organization’s
> firewall before February 1st, 2024, as listed below.

- Allowlist these static IPs in the `US` region to access the `runtime-manager` hosts:

  <table><colgroup><col> <col> <col></colgroup><thead><tr><th>Region</th><th>Name</th><th>IP Address</th></tr></thead><tbody><tr><td><div><div><p><strong>US</strong></p></div></div></td><td><div><div><p>runtime-manager.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>18.214.68.14</p></div></div></td></tr><tr><td><div><div><p><strong>US</strong></p></div></div></td><td><div><div><p>runtime-manager.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>35.174.151.175</p></div></div></td></tr><tr><td><div><div><p><strong>US</strong></p></div></div></td><td><div><div><p>runtime-manager.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>18.213.137.40 (Starting Feb 2024)</p></div></div></td></tr><tr><td><div><div><p><strong>US</strong></p></div></div></td><td><div><div><p>runtime-manager.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>34.232.255.44 (Starting Feb 2024)</p></div></div></td></tr><tr><td><div><div><p><strong>US</strong></p></div></div></td><td><div><div><p>runtime-manager.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>44.209.29.79 (Starting Feb 2024)</p></div></div></td></tr></tbody></table>

- Allowlist these static IPs in the `EU` region to access the `runtime-manager` hosts:

  <table><colgroup><col> <col> <col></colgroup><thead><tr><th>Region</th><th>Name</th><th>IP Address</th></tr></thead><tbody><tr><td><div><div><p><strong>EU</strong></p></div></div></td><td><div><div><p>runtime-manager.eu1.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>18.185.141.77</p></div></div></td></tr><tr><td><div><div><p><strong>EU</strong></p></div></div></td><td><div><div><p>runtime-manager.eu1.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>3.123.216.217</p></div></div></td></tr><tr><td><div><div><p><strong>EU</strong></p></div></div></td><td><div><div><p>runtime-manager.eu1.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>3.127.253.183 (Starting Feb 2024)</p></div></div></td></tr></tbody></table>

## Dynamic IP Addresses

Some of the IP addresses used by Anypoint Platform services are assigned automatically by the
underlying cloud infrastructure. Because these are dynamic, do not implement an allowlist based on
the specific IP addresses assigned to Anypoint services.

Many firewall devices allow you to define Layer 7 firewall rules so that you can filter by
destination name or application type.

Include the following fully qualified hostnames in your Layer 7 firewall rules:

<table><colgroup><col> <col></colgroup><thead><tr><th>Region</th><th>Hostname</th></tr></thead><tbody><tr><td><div><div><p><strong>US</strong></p></div></div></td><td><div><div><p>anypoint.mulesoft.com</p></div></div></td></tr><tr><td><div><div><p><strong>US</strong></p></div></div></td><td><div><div><p>analytics-ingest.anypoint.mulesoft.com</p></div></div></td></tr><tr><td><div><div><p><strong>US</strong></p></div></div></td><td><div><div><p>data-authenticator.anypoint.mulesoft.com</p></div></div></td></tr><tr><td><div><div><p><strong>US</strong></p></div></div></td><td><div><div><p>us1.ingest.mulesoft.com</p></div></div></td></tr><tr><td><div><div><p><strong>US-GOV</strong></p></div></div></td><td><div><div><p>runtime-manager.gov.anypoint.mulesoft.com</p></div></div></td></tr><tr><td><div><div><p><strong>US-GOV</strong></p></div></div></td><td><div><div><p>data-authenticator.gov.anypoint.mulesoft.com</p></div></div></td></tr><tr><td><div><div><p><strong>US-GOV</strong></p></div></div></td><td><div><div><p>gov.anypoint.mulesoft.com</p></div></div></td></tr><tr><td><div><div><p><strong>EU</strong></p></div></div></td><td><div><div><p>eu1.anypoint.mulesoft.com</p></div></div></td></tr><tr><td><div><div><p><strong>EU</strong></p></div></div></td><td><div><div><p>analytics-ingest.eu1.anypoint.mulesoft.com</p></div></div></td></tr><tr><td><div><div><p><strong>EU</strong></p></div></div></td><td><div><div><p>data-authenticator.eu1.anypoint.mulesoft.com</p></div></div></td></tr><tr><td><div><div><p><strong>EU</strong></p></div></div></td><td><div><div><p>eu1.ingest.mulesoft.com</p></div></div></td></tr></tbody></table>

### Allowlist

Allowlist the following URLs, the valid Agents are only 2.2.0+:

<table><colgroup><col> <col></colgroup><thead><tr><th>URL</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>runtime-manager.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>Connection for ARM management capabilities (<strong>public-cert agents</strong>)</p></div></div></td></tr><tr><td><div><div><p>data-authenticator.anypoint.mulesoft.com</p></div></div></td><td><div><div><p>Connection to the metrics ingestion service of arm-monitoring stack (<strong>public-cert agents</strong>)</p></div></div></td></tr></tbody></table>