Supported connectivity schemes for ActiveGates

Depending on your specific requirement, ActiveGate can be used in a Dynatrace SaaS connectivity scheme or a Dynatrace Managed connectivity scheme. The Dynatrace Managed connectivity scheme can be deployed in a number of different deployment scenarios.

Dynatrace requires certain ports and paths to be opened and accessible through the monitored infrastructure, firewalls and other components. The ports are configurable and the default values are shown here.

Dynatrace SaaS connectivity scheme

All possible connections for the SaaS connectivity scheme, with preferred and alternative paths are shown below.

The solid arrows indicate the preferred paths. For example, OneAgent will connect to an Environment ActiveGate, if one is present. It will, however, connect to a the Dynatrace Saas Cluster directly, if no connection to an Environment ActiveGate is possible. The direction of arrows in the diagrams indicates which component initiates the connection.

Dynatrace Managed connectivity scheme

All possible connections for the Dynatrace Managed connectivity scheme—in all possible deployment scenarios—are shown below in one diagram.

The solid arrows indicate the preferred paths. For example, OneAgent will connect to an Environment ActiveGate, if one is present. It will, however, connect to a Cluster ActiveGate, if no connection to an Environment ActiveGate is possible, and it can even connect directly to a Dynatrace Managed Cluster. The direction of arrows in the diagrams indicates which component initiates the connection.

Port usage

If you run Browser monitors or HTTP monitors from private Synthetic locations, you need to make sure the Synthetic-enabled ActiveGate has access to the tested resource. If you use ActiveGate extensions, you need to make sure the ActiveGate executing the extensions has access to the monitored technology.

For Dynatrace Managed, ActiveGate must have network access to other services as well on specific ports, based on your deployment scenario.

Connection hierarchy

ActiveGates exist in the following hierarchy:

ActiveGates can only send data to higher hierarchy levels. It is impossible to send data to the same or lower level of the hierarchy.

Connectivity can also depend on network zones if such are configured. Network zone configuration means that ActiveGates and OneAgents will prefer to communicate with ActiveGates from the same zone, before connecting to ActiveGates outside of the active zone.

Proxy and load balancer configuration

All Dynatrace components (OneAgents, ActiveGates, Dynatrace Cluster) detect their hostnames and distribute them as communication endpoints among each other to achieve the highest possible connection robustness.
This works automatically, unless there are networking devices (proxies, load balancers) in your environment, which should be taken into account, and of which Dynatrace is not aware.

The diagram below shows all possible proxy and load balancer (reverse proxy) placements for an ActiveGate deployment. For simplicity, direct connections—those that are not through proxies or load balancers–are not shown in this diagram. Alternative connections (those that connect through one or more proxies or load balancers), are shown as dashed lines.

ActiveGate headers

You can configure the ActiveGate headers in your firewall.