> Source: [sk178065](https://support.checkpoint.com/results/sk/sk178065)
# sk178065 - Harmony Connect Application Access Setup Requirements
| Property | Value |
|----------|-------|
| Solution ID | sk178065 |
| Date Created | 2022-02-23 |
| Last Modified | 2023-12-19 |
| Technical Level | General |
## Solution
With the **Application Sites** you can manage the sites that hold corporate applications to provide end users with Application-Level access to the applications.
This continuously updating page contains:
1. **Requirements for deploying a Connector** - A lightweight software that acts as the only network interface in your data center.
2. **End-user domain whitelisting list** - If this is needed as a part of your organizational policy.
For example, when end user machine internet access is restricted.
To learn how to set up a site for Application-Level access, see [Setting up an Application Site](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Harmony-Connect-Admin-Guide/Topics-Harmony-Connect-AG/Assets/Setting-up-Site.htm?tocpath=Assets%7CApplication%20Sites%7C_____1).
1. Connector Setup
------------------
### Computer Requirements
* 4 vCPUs (for Hyper-Threading support)
* 16 GB RAM
* 1 Gbps network throughput
* Supported Operating Systems
* Amazon Linux 2, 2023
* CentOS 7.7.1908 (EOL June 2024), 7.9 (EOL June 2024), 9
* Red Hat Linux 7.9, 8.5, 8.6, 8.8, 9.3
* Ubuntu Server 18.04 Long Term Support (LTS), Ubuntu Server 20.04 LTS, 22.04
* SUSE SLES 15.5
* On AWS environment deployment
* t2-micro for testing
* t3-xlarge for non-production or low traffic sites
* c5-xlarge for production or high traffic sites
* Latest Docker Engine installed. To learn more about Docker installation, see for example: [Install Docker on Ubuntu Linux](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Harmony-Connect-Admin-Guide/Topics-Harmony-Connect-AG/Appendix/Linux-and-Docker-installation.htm#Docker_install).
* port 53 is opened (allow DNS resolving)
* Port 444 is opened for the relevant IPs from the table below
* Port 443 is opened for the relevant IPs listed below:
* EU tenants
* URL: https://cm-prod-eu.connect.checkpoint.com/prod-eu/metrics
* IP: 13.248.181.20, 76.223.40.239
* US tenants
* URL: https://cm-prod-us.connect.checkpoint.com/prod-us/metrics
* IP: 15.197.212.38, 3.33.196.224
* AP tenants
* URL: https://cm-prod-ap.connect.checkpoint.com/prod-ap/metric
* IP: 13.248.133.148, 76.223.5.42
* As for why the logs show IP Geolocation as USA:
The Anycast IP that's assigned to Amazon-Global-Accelerator is assigned to the Amazon corporate entity and not to a physical location.
Per ISP border network definitions to choose the next hop.
The address will be shown to US.
The traffic will be subject to the locality of the client, however the destination entity to connect to will always be EU.
### How to install docker on Redhat/Centos 8.5 without updating OS version number
sudo dnf install -y yum-utils
sudo yum config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo
sudo yum --disablerepo="\*" --enablerepo=docker-ce-stable update
sudo dnf remove podman buildah
sudo dnf install docker-ce docker-ce-cli containerd.io
sudo systemctl enable docker.service
sudo systemctl start docker.service
### Supported IPTables
The Connector supports iptables and iptables-nft
### Network Requirements
|--------------------|---------------------------------------------------|--------------------------------------------|------------------------|-----------------------------------------|-----------------------------------------------------|
| **Account Region** | **Control Plane** | **Control Plane IP** | **Address Data Plane** | **Data Plane IP Address** | **FQDN** |
| **EU** | grpc-prod-eu.connect.checkpoint.com
| 3.126.203.189 3.124.53.177
| Bahrain | 52.223.17.16 35.71.174.226 | gw-me-1-a.odosecurity.io |
| **EU** | | | | 3.33.224.232 15.197.240.4 | gw-me-1-b.odosecurity.io |
| **EU** | | | Frankfurt | 13.248.205.57 76.223.68.209 | gw-eu-2-a.odosecurity.io gw-eu-2-b-a.odosecurity.io |
| **EU** | | | | 75.2.61.4 99.83.183.217 | gw-eu-2-b.odosecurity.io gw-eu-2-b-b.odosecurity.io |
| **EU** | | | Mumbai | 3.33.223.250 15.197.219.47 | gw-apac-5-a.odosecurity.io |
| **EU** | | | | 99.83.141.250 75.2.117.39 | gw-apac-5-b.odosecurity.io |
| **EU** | | | Singapore | 15.197.154.33 3.33.150.198 | gw-apac-3-a.odosecurity.io |
| **EU** | | | | 15.197.234.9 3.33.219.207 | gw-apac-3-b.odosecurity.io |
| **EU** | | | Sydney | 13.54.182.47 3.33.184.238 15.197.181.32 | gw-apac-4-a.odosecurity.io |
| **EU** | | | | 54.66.92.228 3.33.211.241 15.197.228.33 | gw-apac-4-b.odosecurity.io |
| **EU** | | | Oregon | 52.223.1.21 35.71.134.195 | gw-us-5-a.odosecurity.io |
| **EU** | | | | 15.197.177.60 3.33.176.207 | gw-us-5-b.odosecurity.io |
| **EU** | | | Seoul | 15.197.183.31 3.33.179.202 | gw-apac-6-a.odosecurity.io |
| **EU** | | | | 15.197.201.23 3.33.243.239 | gw-apac-6-b.odosecurity.io |
| **EU** | | | Ireland | 3.33.218.254 15.197.228.41 | gw-eu-4-a.odosecurity.io |
| **EU** | | | | 13.248.200.18 76.223.78.245 | gw-eu-4-b.odosecurity.io |
| **US** | grpc-prod-us.connect.checkpoint.com
| 54.203.237.188 35.164.242.69
| North Virginia | 13.248.137.3 76.223.13.201 | gw-us-4-a.odosecurity.io |
| **US** | | | | 15.197.227.18 3.33.235.236 | gw-us-4-b.odosecurity.io |
| **US** | | | Oregon | 75.2.18.30 99.83.156.243 | gw-us-2-a.odosecurity.io |
| **US** | | | | 75.2.96.62 99.83.133.205 | gw-us-2-b.odosecurity.io |
| **US** | | | Sao Paulo | 75.2.125.32 76.233.111.229 | gw-sa-1-a.odosecurity.io |
| **US** | | | | 15.197.251.48 3.33.245.214 | gw-sa-1-b.odosecurity.io |
| **AP** | grpc-prod-ap.connect.checkpoint.com | 13.54.43.141 13.237.173.108 54.79.95.149 | Sydney | 13.248.218.60 76.223.67.222 | gw-apac-7-a.odosecurity.io |
| **AP** |
|
| | 75.2.124.31 76.223.108.197 | gw-apac-7-b.odosecurity.io |
2. End-User Domain Whitelisting
-------------------------------
#### In case your organizational policy requires domain whitelisting from the end-user perspective, you can use these domains:
Control plane:
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **US Region** | **EU Region** |
| * admin.odo.io * admin-eu.odo.io * admin-us.odo.io * api.odo.io * api-eu.odo.io * api-gw-prod-us-saas.checkpoint.security * api-private.atlassian.com * api-prod-us.connect.checkpoint.com * api-us.odo.io * assets.odo.io * assets-prod-us.odo.io * auth-prod-us.connect.checkpoint.com * auth-prod-us.odo.io * auth-us.odo.io * axcdn.bootstrapcdn.com * cdn.auth0.com * cdn.eu.auth0.com * cdn.us.auth0.com * checkpoint.com * checkpointcloudsec.com * cloudinfra-gw.portal.checkpoint.com * cloudinfra-gw-eu.portal.checkpoint.com * cloudinfra-gw-us.portal.checkpoint.com * digitalocean.com * docs.odo.io * engage.useriq.com * feed.useriq.com * fonts.googleapis.com * fonts.gstatic.com * google-analytics.com * googletagmanager.com * image.freepik.com * jsd-widget.atlassian.com * maps.googleapis.com * maps.gstatic.com * maxcdn.bootstrapcdn.com * metrics.useriq.com * nsaas-bundle-prd.s3.amazonaws.com * odo-access-assets.s3.eu-central-1.amazonaws.com * odoprod.auth0.com * odoprod.us.auth0.com * p.typekit.net * portal.checkpoint.com * portal.odo.io * portal-eu.odo.io * portal-us.odo.io * sc1.checkpoint.com * secure.gravatar.com * static.assets.checkpoint.com * stream.useriq.com * supportcenter.checkpoint.com * us.connect.checkpoint.com * connect.checkpoint.com * use.typekit.net | * admin.odo.io * admin-eu.odo.io * admin-us.odo.io * api.odo.io * api-eu.odo.io * api-gw-prod-eu-saas.checkpoint.security * api-private.atlassian.com * api-prod-eu.connect.checkpoint.com * api-us.odo.io * assets.odo.io * assets-prod-eu.odo.io * auth-prod-eu.connect.checkpoint.com * auth-prod-eu.odo.io * auth-eu.odo.io * axcdn.bootstrapcdn.com * cdn.auth0.com * cdn.eu.auth0.com * cdn.us.auth0.com * checkpoint.com * checkpointcloudsec.com * cloudinfra-gw.portal.checkpoint.com * cloudinfra-gw-eu.portal.checkpoint.com * cloudinfra-gw-us.portal.checkpoint.com * digitalocean.com * docs.odo.io * engage.useriq.com * eu.connect.checkpoint.com * connect.checkpoint.com * feed.useriq.com * fonts.googleapis.com * fonts.gstatic.com * google-analytics.com * googletagmanager.com * image.freepik.com * jsd-widget.atlassian.com * maps.googleapis.com * maps.gstatic.com * maxcdn.bootstrapcdn.com * metrics.useriq.com * nsaas-bundle-prd.s3.amazonaws.com * odo-access-assets.s3.eu-central-1.amazonaws.com * odoprod.auth0.com * odoprod.eu.auth0.com * p.typekit.net * portal.checkpoint.com * portal.odo.io * portal-eu.odo.io * portal-us.odo.io * sc1.checkpoint.com * secure.gravatar.com * static.assets.checkpoint.com * stream.useriq.com * supportcenter.checkpoint.com * use.typekit.net |
**Data plane:**
Allow all the bellow domains according to the relevant dataplane ID (as appears in the table below):
* ssh.\.checkpoint.security
* psql.\.checkpoint.security
* mysql.\.checkpoint.security
* tunnel.\.checkpoint.security
* rdp.\.checkpoint.security
* rdp-native.\.checkpoint.security
In addition, allow the below DNS according to the customer application sites:
|--------------------------|-------------------|-------------------|----------------------------|
| **Control Plane region** | **Site location** | **Data plane ID** | **URLs** |
| **EU** | Bahrain | me-1 | \*.me-1.checkpoint.com |
| **EU** | Germany | eu-2 | \*.eu-2.checkpoint.com |
| **EU** | Ireland | eu-4 | \*.eu-4.checkpoint.com |
| **EU** | Singapore | apac-3 | \*.apac-3.checkpoint.com |
| **EU** | Sydney | apac-4 | \*.apac-4.checkpoint.com |
| **EU** | Mumbai | apac-5 | \*.apac-5.checkpoint.com |
| **EU** | Seoul | apac-6 | \*.apac-6.checkpoint.com |
| **EU** | Oregon | us-3 | \*.us-3.checkpoint.com |
| **US** | Oregon | us-2 | \*.us-2-new.checkpoint.com |
| **US** | North Virginia | us-4 | \*.us-4.checkpoint.com |
| **US** | Sao Paulo | sa-1 | \*.sa-1.checkpoint.com |
| **AP** | Sydney | apac-7 | \*.apac-7.checkpoint.com |
For Example:
Customer who use Singapore site should allow:
* ssh.apac-3.checkpoint.security
* psql.apac-3.checkpoint.security
* mysql.apac-3.checkpoint.security
* tunnel.apac-3.checkpoint.security
* rdp.apac-3.checkpoint.security
* rdp-native.apac-3.checkpoint.security
* \*.apac-3.checkpoint.security
Troubleshooting known issues
============================
|-------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| How to verify if the TLS tunnels from the Connector to POP are created and functioning properly | 1. Verify that the connector is running over a supported host machine version. 2. Verify that tunnels are established successfully. This can be seen using the connector's monitoring feature. If tunnels are not established, verify there is no third party component blocking communication (for example internal/external firewall). 3. Verify that the POP functions properly by accessing a resource in the datacenter. |
| How to view the errors from the Connector logs? | Extracting logs: docker logs CONNECTOR_CONTAINER_ID \> my_connector_logs.log Watching connector logs in real time: docker logs -f CONNECTOR_CONTAINER_ID --tail 10 Notes: 1. CONNECTOR_CONTAINER_ID is replaced with the container ID of the connector (the container ID can be seen using 'docker ps' command) 2. 'tail 10' parameters will show real time logs from the last 10 logs |
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content