Ports, IP Addresses, and Hostnames to Allow | MuleSoft Documentation
# Ports, IP Addresses, and Hostnames to Allow
Private Cloud Edition 
In your network, you must add the hostnames and ports of various parts of Anypoint Platform to your allowlist to enable the Runtime Manager agent in a customer-hosted Mule runtime engine to communicate with the online Anypoint Platform APIs and services managed by MuleSoft.
These tables show you the ports or IP addresses and hostnames to add to your allowlists to allow communication between the agent and the Runtime Manager console.
Because the following endpoints use mutual TLS authentication, to establish the connection, you must configure SSL passthrough to allow the certificates:
  * runtime-manager.anypoint.mulesoft.com
  * runtime-manager.eu1.anypoint.mulesoft.com
  * runtime-manager.gov.anypoint.mulesoft.com
  * data-authenticator.anypoint.mulesoft.com
  * data-authenticator.gov.anypoint.mulesoft.com
  * us1.ingest.mulesoft.com
  * eu1.ingest.mulesoft.com


In addition, the following endpoints use WebSockets:
  * runtime-manager.anypoint.mulesoft.com
  * runtime-manager.eu1.anypoint.mulesoft.com
  * runtime-manager.gov.anypoint.mulesoft.com


Ports, IP addresses, and hostnames are required for outbound connectivity. Inbound connectivity is not required to your network and servers. The connection between customer-hosted Mule runtime and Anypoint Platform is established via persistent Websocket connections. All connections are outbound.   
---  
## Ports
Region | Name | Port  
---|---|---  
anypoint.mulesoft.com  
runtime-manager.anypoint.mulesoft.com  
analytics-ingest.anypoint.mulesoft.com  
data-authenticator.anypoint.mulesoft.com  
exchange-files.anypoint.mulesoft.com  
exchange2-asset-manager-kprod.s3.amazonaws.com  
us1.ingest.mulesoft.com  
runtime-manager.gov.anypoint.mulesoft.com  
data-authenticator.gov.anypoint.mulesoft.com  
gov.anypoint.mulesoft.com  
exchange-files.gov.anypoint.mulesoft.com  
exchange2-asset-manager-kgprod.s3.us-gov-west-1.amazonaws.com  
eu1.anypoint.mulesoft.com  
runtime-manager.eu1.anypoint.mulesoft.com  
analytics-ingest.eu1.anypoint.mulesoft.com  
data-authenticator.eu1.anypoint.mulesoft.com  
exchange2-asset-manager-kprod-eu.s3.eu-central-1.amazonaws.com  
eu1.ingest.mulesoft.com  
## Static IP Addresses
As part of our continuous infrastructure improvement, MuleSoft introduces a new set of static IP addresses in Runtime Manager to augment existing ones. To avoid service disruption, allow the IP addresses or domains, depending on your network policy, through your organization’s firewall before February 1st, 2024, as listed below. For more information, visit KB: New IP addresses in Runtime Manager 2024 February .   
---  
  * Allowlist these static IPs in the `US` region to access the `runtime-manager` hosts:
Region | Name | IP Address  
---|---|---  
runtime-manager.anypoint.mulesoft.com |  18.214.68.14  
runtime-manager.anypoint.mulesoft.com |  35.174.151.175  
runtime-manager.anypoint.mulesoft.com |  18.213.137.40 (Starting Feb 2024)  
runtime-manager.anypoint.mulesoft.com |  34.232.255.44 (Starting Feb 2024)  
runtime-manager.anypoint.mulesoft.com |  44.209.29.79 (Starting Feb 2024)  
  * Allowlist these static IPs in the `EU` region to access the `runtime-manager` hosts:
Region | Name | IP Address  
---|---|---  
runtime-manager.eu1.anypoint.mulesoft.com |  18.185.141.77  
runtime-manager.eu1.anypoint.mulesoft.com |  3.123.216.217  
runtime-manager.eu1.anypoint.mulesoft.com |  3.127.253.183 (Starting Feb 2024)  


## Dynamic IP Addresses
Some of the IP addresses used by Anypoint Platform services are assigned automatically by the underlying cloud infrastructure. Because these are dynamic, do not implement an allowlist based on the specific IP addresses assigned to Anypoint services.
Many firewall devices allow you to define Layer 7 firewall rules so that you can filter by destination name or application type.
Include the following fully qualified hostnames in your Layer 7 firewall rules:
Region | Hostname  
---|---  
anypoint.mulesoft.com  
analytics-ingest.anypoint.mulesoft.com  
data-authenticator.anypoint.mulesoft.com  
us1.ingest.mulesoft.com  
runtime-manager.gov.anypoint.mulesoft.com  
data-authenticator.gov.anypoint.mulesoft.com  
gov.anypoint.mulesoft.com  
eu1.anypoint.mulesoft.com  
analytics-ingest.eu1.anypoint.mulesoft.com  
data-authenticator.eu1.anypoint.mulesoft.com  
eu1.ingest.mulesoft.com  
### Allowlist
Allowlist the following URLs, the valid Agents are only 1.12.0+ (in Mule 3.x) and 2.2.0+ (in Mule 4.x):
URL | Description  
---|---  
runtime-manager.anypoint.mulesoft.com |  Connection for ARM management capabilities (**public-cert agents**)  
data-authenticator.anypoint.mulesoft.com |  Connection to the metrics ingestion service of arm-monitoring stack (**public-cert agents**)