Outbound network access requirements for Instana SaaS deployments

Before you deploy Instana SaaS, set the firewall and proxy properly to allow the following outbound network access:

Instana agent and sensor repositories

  • The following repository needs to be accessed to download static host agents and dynamic host agents:

    Repository: https://containers.instana.io

    • Port: 443
    • Protocol: HTTPS
    • Authentication: no

  • The following repository needs to be accessed to download agent images from the IBM Cloud Container Registry (ICR):

    Repository: https://icr.io/instana

    • Port: 443
    • Protocol: HTTPS
    • Authentication: no

  • The following repository needs to be accessed if you want to use the packages installation method to install the host agent:

    Repository: https://packages.instana.io/

    • Port: 443
    • Protocol: HTTPS
    • Authentication: no

  • The following repository needs to be accessed if you want to use the one-liner Installation procedure to install the host agent:

    Repository: https://setup.instana.io/

    • Port: 443
    • Protocol: HTTPS
    • Authentication: no

  • New sensors, updates to existing sensors, and agent updates are pulled daily from the following repository if dynamic agents are installed:

    Repository: http://artifact-public.instana.io/

    • Port: 443
    • Protocol: HTTPS
    • Authentication: yes

  • The following URL repository needs to be accessed to store Synthetic PoP Helm packages, autotrace-webhook, and agent Helm packages:

    Repository: https://agents.instana.io/helm

    • Port: 443
    • Protocol: HTTPS
    • Authentication: yes

Other network access requirements

Requirement Regions
Blue(AWS EU), Red(AWS US)
Green(GCP EU), Orange(GCP US), Coral(GCP US)
 Teal(AWS APAC), Mizu(AWS APAC)
URL of Instana SaaS instance UI needs to be accessed URL: https://[unit]-[tenant].instana.io
Port: 443
Protocol: HTTPS
Authentication: no
URL of the APM endpoint needs to be accessed URL: https://ingress-[Region]-saas.instana.io
Port: 443
Protocol: HTTPS
Authentication: no
URL of the End-user monitoring (EUM) endpoint needs to be accessed URL: https://eum-[Region]-saas.instana.io/
Port: 443
Protocol: HTTPS
Authentication: no
 URL: https://[Region].instana.io/eum/
Port: 443
Protocol: HTTPS
Authentication: no
URL of the Synthetic endpoint needs to be accessed URL: https://synthetics-[Region]-saas.instana.io/
Port: 443
Protocol: HTTPS
Authentication: no
 URL: https://[Region].instana.io/synthetics/
Port: 443
Protocol: HTTPS
Authentication: no
URL of the Serverless endpoint needs to be accessed URL: https://serverless-[Region]-saas.instana.io
Port: 443
Protocol: HTTPS
Authentication: no
 URL: https://[Region].instana.io/serverless/
Port: 443
Protocol: HTTPS
Authentication: no
URL of the OpenTelemetry Protocol (OTLP) endpoint needs to be accessed URL: https://otlp-[Region]-saas.instana.io
Port: 443
Protocol: HTTPS
Authentication: no
 URL (HTTP): https://otlp-http-[Region]-saas.instana.io
URL (GRPC): https://otlp-grpc-[Region]-saas.instana.io
Port: 443
Protocol: HTTPS
Authentication: no
Product user analytics is optional and can be disabled URL: https://cdn.mxpnl.com
Mixpanel is a product analytic system that is used for recording analytics and improving the product experience URL: https://api-js.mixpanel.com
Used to download the Instana website monitoring agent eum.min.js URL: https://eum.instana.io
Third-party system used by Instana to prompt a satisfaction survey. Not mandatory to using the product. URL: https://fast.appcues.com