On-prem gateway

The On-prem gateway connects a Zato environment running in a public cloud to systems that reside on a private network, such as databases, APIs and file servers.

Zato itself is self-hosted and runs in your own data center, in a private cloud or in a public cloud, as described under Installation. The gateway is used only when Zato runs outside the private network of the systems it connects to.

The gateway is installed on a host on the private network and connects to the Zato container. Once it is connected, Zato accesses the on-prem systems as if it ran on the private network itself. The connection is always made from the private network outwards, so a deployment requires neither a VPN nor an inbound firewall rule.

Installation

The gateway runs on Linux hosts with systemd. On Windows, it runs under WSL2, in a Linux distribution with systemd enabled, and setting up WSL2 is described in Installation on Windows.

To install a gateway:

1. In the Dashboard, open System and then On-prem gateways, and create a gateway with the on-prem systems it provides access to, as described in Configuration.
2. Click Enrollment token next to the gateway, then click Copy.

3. On a host on the private network that meets the requirements, run the command below, with the token in place of TOKEN:

   sudo curl -fsSL -o /usr/local/bin/zato-on-prem-gateway \
     https://github.com/zatosource/zato-on-prem-gateway/releases/latest/download/zato-on-prem-gateway-linux-amd64 && \
     sudo chmod +x /usr/local/bin/zato-on-prem-gateway && \
     sudo zato-on-prem-gateway install --token TOKEN
   

   On ARM64 hosts, use linux-arm64 in place of linux-amd64. When the host reaches the internet through a proxy, the proxy is set as described in Proxies.

The gateway then runs as a service that starts on boot, and the Dashboard shows it as Connected. The other commands of the gateway are listed in the On-prem gateway reference.

Outgoing connections

An outgoing connection is configured with the host name and the port of the on-prem system, exactly as it would be if Zato ran on the private network:

Host:     erp-db.corp.local
Port:     5432
Database: production

No property of an outgoing connection refers to the gateway. The same applies to every kind of outgoing connection, including SQL, REST, SOAP, AMQP, LDAP and SFTP. TLS certificates are validated as they are on a direct connection.

Configuration

Gateways are configured in the Dashboard, under System and then On-prem gateways. A gateway has the following properties.

A list of on-prem systems takes the following form:

erp-db.corp.local:5432
crm.corp.local:443
mq.corp.local:1414

Only the systems on the list can be accessed through the gateway. The same host:port cannot be configured under two gateways, because two private networks may each have a different system under the same name and Zato would not know which one a connection is meant for.

Port numbers

Note that each of the following port numbers can be used by only one on-prem system: 8183, 8184, 8185, 8186, 11223, 11224, 11553, 11554 and 17010.

The SSH port of the container, 22 by default, cannot be used by on-prem systems.

Enrollment

A gateway is connected to Zato with the enrollment token that is copied from the Dashboard during the installation.

A token is valid for 24 hours and can be used once. Issuing a new token for a gateway replaces any earlier token of that gateway that has not been used yet. After enrollment, the gateway authenticates with its own key, which is generated on the host and never leaves it. No further action is required when the Zato environment or the host is restarted, the gateway reconnects on its own.

Gateway list

The list of gateways in the Dashboard is refreshed on its own and shows the following columns for each gateway.

Status reference

The Dashboard reports one of the following statuses for each gateway.

Re-enrollment

A gateway is enrolled again when the host is reinstalled or the gateway is moved to another host, as described in Relocating a gateway. To revoke the key of a gateway, click Reset key next to it. The gateway is disconnected and remains so until it is enrolled again.

The Require key resets setting determines how a new enrollment token is treated.

Public address

An enrollment token contains the address the gateway connects to. By default, this is the host name the Dashboard is reached on, combined with the port of the load balancer of the Zato environment. When gateways are to use a different address, for instance one published by a Kubernetes ingress, set Zato_On_Prem_Gateway_Public_Address to that address, e.g. https://api.example.com.

Configuration as code

Gateways are part of enmasse and are maintained in the same repository as the rest of an environment's configuration:

on_prem_gateway:

  - name: head-office
    is_active: true
    is_key_reset_required: true
    hosts:
      - erp-db.corp.local:5432
      - crm.corp.local:443

Enrollment tokens and keys are not part of an exported file.