What an Access Tier is

An Access Tier is an identity-aware proxy and gateway that mediates access between entities on the internet and the internal services running in your private network.

Why you use an Access Tier

Internal applications and services are not directly exposed to the internet. Instead of granting broad network access, the Access Tier sits at the edge of your network and evaluates each connection against your access policies before forwarding traffic to the service behind it. This allows you to publish internal Web Services, Infrastructure Services, and Service Tunnels to authorized users without opening the underlying network.

How it works

1. The Access Tier is deployed with a public IP address that is reachable from the internet and accepts inbound connections from clients.
2. When a client connects, the Access Tier verifies the client’s identity and applies the access policies attached to the requested Service.
3. If access is permitted, the Access Tier proxies the connection to the corresponding internal service.

Tip: For step-by-step setup instructions, see Deploy Access Tier.

Ports and connectivity

The Access Tier is an identity-aware proxy and gateway that mediates access between entities on the internet and your internal services. Each Access Tier has a public IP address that is reachable from the internet and accepts inbound connections on the following ports:

• TCP 80 and TCP 443 (Web Services),
• TCP 8443 (Infrastructure Services), and
• UDP 51820 (Service Tunnels).

Private Edge Access Tiers require outbound access to a TCP port between 21000-59999, outbound towards CSE Shields, located in one of two destinations based on the org’s data center location: gkp-usw1-at01.infra.banyanops.com (North America) and gkp-euw2-at01.infra.banyanops.com (Europe).

TCP ports are provisioned on a per org basis.

Sections