Outbound network access requirements for self-hosted Instana deployments

Before you deploy Instana backend in a self-hosted environment, set the firewall and proxy properly to allow the following outbound network access:

Instana backend components are provided by using remote software repositories and a remote registry that contains Docker images. For billing purposes, the submission of usage information to the central Instana Accounting System is required. What follows is a list of all remote systems that need to be reachable during installation and operation. The Instana console uses your sales and agent keys as login credentials.

Table 1. Required outbound ports
Port	Protocol	Authentication	Repository or URL	Required by	Comments
443	TCP	Yes	`https://artifact-public.instana.io`	- Standard Edition - Custom Edition - Classic Edition	Repository for kubectl plug-in, package files for the Classic Edition, Instana backend images, new sensors, updates to existing sensors, and agent updates for dynamic agents .
443	TCP	Yes	`https://instana.io`	- Standard Edition - Custom Edition - Classic Edition	Required for license download and to send Instana usage information to Instana's accounting backend at `https://instana.io/portal/statistics/usage`.
443	TCP	No	`https://icr.io/instana`	- Standard Edition - Custom Edition - Classic Edition	Repository for agent images from the IBM Cloud Container Registry (ICR).
443	TCP	Yes	`https://packages.instana.io`	- Standard Edition - Custom Edition - Classic Edition	Repository for packages to install the host agent.
443	TCP	Yes	`https://setup.instana.io`	- Standard Edition - Custom Edition - Classic Edition	Repository for the script to install the host agent.
443	TCP	Yes	`https://agents.instana.io/helm`	- Standard Edition - Custom Edition - Classic Edition	Repository for Synthetic PoP Helm packages, `autotrace-webhook`, and agent Helm packages.
			`http://.trustarc.com https://.trustarc.com http://.prefmgr-cookie.truste-svc.net https://.prefmgr-cookie.truste-svc.net http://.tealium.com https://.tags.tiqcdn.com https://.tealium.com http://.tags.tiqcdn.com https://www.ibm.com https://www-api.ibm.com https://1.www.s81c.com`	- Standard Edition - Custom Edition - Classic Edition	The current and strategic Cookie Consent solution is based on TrustArc. TrustArc helps ensure compliance with various global data privacy laws and the Tag Management solution is based on Tealium iQ. The following domains are authorized for transmitting data as part of both implementations. For more information, see Privacy and complaince and Tealium.
			`https://cdn.walkme.com`	- Standard Edition - Custom Edition - Classic Edition	Product user analytics and guidance is optional. To disable it, contact the Instana support team.
			`cdn.segment.com api.segment.io`	- Standard Edition - Custom Edition - Classic Edition	Segment tailors your experience with supporting relevant features, guidance, and performance enhancements. This improvement might send data to `api.segment.io` and load resources from `cdn.segment.com`. This feature is optional. You can opt out by disabling functional cookies in your cookie preferences settings.