Cisco
Login
Search
Software Secure Workload
Activity Configure

Deploy Software Agents on Workloads Deploy Software Agents Connectivity Information

Last updated: Jun 09, 2025

Connectivity Information

In general, when the agent is installed on the workload, it makes several network connections to the back-end services hosted on the Secure Workload cluster. The number of connections will vary depending on the agent type and its functions.

The following table captures various permanent connections that are made by various agent types.

Table 1. Agent Connectivity

Agent type

Config server

Collectors

Enforcement backend

visibility (on-premises)

CFG-SERVER-IP:443

COLLECTOR-IP:5640

N/A

visibility (SaaS)

CFG-SERVER-IP:443

COLLECTOR-IP:443

N/A

enforcement

(on-premises)

CFG-SERVER-IP:443

COLLECTOR-IP:5640

ENFORCER-IP:5660

enforcement (SaaS)

CFG-SERVER-IP:443

COLLECTOR-IP:443

ENFORCER-IP:443

docker images

CFG-SERVER-IP:443

N/A

N/A

Legends:

  • CFG-SERVER-IP is the IP address of the config server.

  • COLLECTOR-IP is the IP address of the collector. Deep visibility and enforcement agents connect to all available collectors.

  • ENFORCER-IP is the IP address of the enforcement endpoint. The enforcement agent connects to only one of the available endpoints.

  • For Kubernetes/Openshift agent deployments, the installation script does not contain the agent software - Docker images containing the agent software are pulled from the Secure Workload cluster by every Kubernetes/Openshift node. These connections are established by the container run time image fetch component and directed at CFG-SERVER-IP:443.

Navigate to Platform > Cluster Configuration to know the config server IP and collector IP.

  • Sensor VIP is for the config server IP: The IP address that has been set up for the config server in this cluster.

  • External IPs are for collectors IPs and enforcer: If this is populated, when assigning external cluster IP addresses, the selection process is restricted to only IP addresses defined in this list, that are part of the external network.


 

  • The Secure Workload agent always acts as a client to initiate the connections to the services hosted within the cluster, and never opens a connection as a server.

  • Agents, for which upgrade is supported, periodically perform HTTPS requests (port 443) to the cluster sensor VIP to query for available packages.

  • An agent can be located behind a NAT server.

Connections to the cluster might be denied if the workload is behind a firewall, or if the host firewall service is enabled. In such cases, administrators must create appropriate firewall policies to allow the connections.

Previous topic Other Agent-Like Tools Next topic Security Exclusions