On-prem Gateway

The On-prem Gateway connects a Zato environment running in a public cloud to systems that reside on a private network, such as databases, APIs and file servers.

The gateway is installed on a host on the private network and connects to the Zato container. Once it is connected, Zato accesses the on-prem systems as if it ran on the private network itself. The connection is always made from the private network outwards, so a deployment requires neither a VPN nor an inbound firewall rule.

The gateway runs on Linux hosts, and on Windows hosts under WSL2. Its installation is covered in Installing the On-prem Gateway.

Outgoing connections

An outgoing connection is configured with the host name and the port of the on-prem system, exactly as it would be if Zato ran on the private network:

Host:     erp-db.corp.local
Port:     5432
Database: production

No property of an outgoing connection refers to the gateway. The same applies to every kind of outgoing connection, including SQL, REST, SOAP, AMQP, LDAP and SFTP. TLS certificates are validated as they are on a direct connection.

Configuration

Gateways are configured in the Dashboard, under System and then On-prem gateways. A gateway has the following properties.

A list of on-prem systems takes the following form:

erp-db.corp.local:5432
crm.corp.local:443
mq.corp.local:1414

Only the systems on the list can be accessed through the gateway. The same host:port cannot be configured under two gateways, because two private networks may each have a different system under the same name and Zato would not know which one a connection is meant for.

Port numbers

Note that each of the following port numbers can be used by only one on-prem system: 8183, 8184, 8185, 8186, 11223, 11224, 11553, 11554 and 17010.

The SSH port of the container, 22 by default, cannot be used by on-prem systems.

Enrollment

A gateway is connected to Zato with an enrollment token issued in the Dashboard.

To enroll a gateway:

1. In the Dashboard, open System and then On-prem gateways.
2. Click Enrollment token next to the gateway.
3. Click Copy.
4. Provide the token to the gateway on the on-prem host, as described in Installing the On-prem Gateway.

A token is valid for 24 hours and can be used once. Issuing a new token for a gateway replaces any earlier token of that gateway that has not been used yet. After enrollment, the gateway authenticates with its own key, which is generated on the host and never leaves it. No further action is required when the Zato environment or the host is restarted, the gateway reconnects on its own.

Gateway list

The list of gateways in the Dashboard is refreshed on its own and shows the following columns for each gateway.

Status reference

The Dashboard reports one of the following statuses for each gateway.

Re-enrollment

A gateway is enrolled again when the host is reinstalled or the gateway is moved to another host. To revoke the key of a gateway, click Reset key next to it. The gateway is disconnected and remains so until it is enrolled again.

The Require key resets setting determines how a new enrollment token is treated.

Public address

An enrollment token contains the address the gateway connects to. By default, this is the host name the Dashboard is reached on, combined with the port of the load balancer of the Zato environment. When gateways are to use a different address, for instance one published by a Kubernetes ingress, set Zato_On_Prem_Gateway_Public_Address to that address, e.g. https://api.example.com.

Configuration as code

Gateways are part of enmasse and are maintained in the same repository as the rest of an environment's configuration:

on_prem_gateway:

  - name: head-office
    is_active: true
    is_key_reset_required: true
    hosts:
      - erp-db.corp.local:5432
      - crm.corp.local:443

Enrollment tokens and keys are not part of an exported file.