# Networks

1. [Home](https://www.agilicus.com/)
2. [Agilicus AnyX Administrative Web Interface](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/)
3. [Resources](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/resources/)
4. Networks

![](https://www.agilicus.com/www/000c5f76-featured-anyx-admin-resourcesnetworks.png)## Networks

[CONTACT](/contact-us/)

The **Networks** pages (routes `/network-overview` and `/network-new`) manage global network resources. A network is a global resource, usually a TCP service such as an internal server or a database, available from your domain of control to applications running on the platform. The workload firewall gates access to these resources. See [Resources (concepts)](/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/resources/) for where networks fit in the platform.

## Purpose

A network resource names a service inside your private network (hostname or IP plus ports and protocol) and makes it reachable through the platform. Applications running on the platform, launchers, and other workloads connect to the network resource through the connector, and the workload firewall applies your access rules. Networks are the building block that forwarding services and connectors route on: the same network that a database or desktop resource uses can be exposed to workloads.

The Networks overview lists every network with its address, ports, protocol, connector and diagnostic mode, and lets you create, edit and delete networks, including creating several at once from a spreadsheet. The New Network wizard steps through the connector, name, address, advanced options, a review and a done step.

## Why use it

- Expose an internal TCP service (such as a database or an internal server) to applications running on the platform, with no inbound ports. See [Zero trust architecture](/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/zero-trust-architecture/).
- Make one network resource available to workloads and to forwarding services at other sites, without a virtual private network.
- Control how the service is reached: TLS in either direction, hostname exposure, and dynamic source ports for launchers.
- Provision many networks at once from a comma-separated values (CSV) file.

## When to use it

- When an application running on the platform needs to reach an internal service that is not itself an exposed application, database, SSH or desktop resource.
- When a connector at another site needs access to a service at your site (see [Forwarding services](/anyx-guide/agilicus-anyx-administrative-web-interface/resources/connectors/#forwarding-services)).
- Whenever you add, change or remove a network, or change how the workload firewall reaches it.

**Prerequisite**: permission to administer networks (an owner or administrator role). Without it, the page shows a *no permissions* message.

## How to use it

### Networks overview

1. Open **Resources > Networks > Overview** from the left navigation.

![Networks overview](https://www.agilicus.com/www/67a17be5-networks-overview.png)    The table lists every network with its name, hostname or IP, ports, protocol, override IP, connector, policies, diagnostic mode and an actions menu. The name, hostname, ports and override IP cells are editable inline.

1. Expand a network row (the chevron at the end of the row) to reveal its advanced options:

![Networks overview with expanded row](https://www.agilicus.com/www/c6e5ac57-networks-overview-expanded.png)    The expanded detail shows whether the network is accessed via TLS, verifies TLS, is exposed as a hostname, supports only HTTP/1.1, uses external forwarding, dynamically allocates the listening port, and any source port or source address overrides.

1. Use the toolbar buttons to **ADD NETWORK**, **ADD MULTIPLE FROM CSV**, or delete selected rows, and the search box to filter the table.

1. Open the **more** menu on a network row for the row actions:

![Networks overview row actions](https://www.agilicus.com/www/e25c9ca6-networks-overview-row-actions.png)    - **Disable Diagnostic Mode** (or **Enable Diagnostic Mode**): toggles the network's diagnostic mode, which logs the traffic the workload firewall handles.
- **Search in Audits**: jumps to the audit subsystem filtered to this network.
- **Configure Policies**: attaches policies to the network.

### Creating a network with the wizard

1. Open **Resources > Networks > New**. The wizard has six steps: **Select connector**, **Network name**, **Address**, **Advanced Configuration (optional)**, **Apply**, and **Done**.

\#### Step 1: Select connector

1. Choose the connector that fronts the network. If you have not created one, use **Resources > Connectors > New** first, then return and select it. Tick **External Forwarding** if the network should send data out to the internet from the Agilicus cloud rather than to a connector at your site.

![Network wizard: step 1, connector](https://www.agilicus.com/www/4d7f68b1-networks-new-step1-connector.png)    ![Network wizard: step 1, connector selected](https://www.agilicus.com/www/ce827a7b-networks-new-step1-connector-selected.png)    \#### Step 2: Network name

1. Enter the **network name**. The tooltip explains that this name must be a valid hostname and uniquely identifies the network within this organisation.

![Network wizard: step 2, name](https://www.agilicus.com/www/4d7f68b1-networks-new-step2-name.png)    \#### Step 3: Address

1. Enter the **hostname or IP** of the network, the **ports** (a port or a comma-separated list, for example `80, 443` or `1000-2000`), and choose the **protocol**: TCP or UDP.

![Network wizard: step 3, address](https://www.agilicus.com/www/d8cd6b56-networks-new-step3-address.png)    \#### Step 4: Advanced Configuration (optional)

1. Choose whether the network has additional options. Choosing **Yes** reveals:

- the **override IP**, which replaces the destination IP when the connector forwards the network;
- **My internal network service uses TLS**: whether the service is reached with TLS;
- **My internal network service verifies TLS**: whether to verify the service's certificate;
- **My internal network service exposes the network as a TLS endpoint**: whether the network is exposed to clients as a TLS endpoint;
- **My launchers dynamically allocate the listening port**: whether launchers choose the listening port at run time;
- the **source port override** and **source address override**, which change the source address and port the workload firewall uses when connecting.

![Network wizard: step 4, advanced](https://www.agilicus.com/www/b083ebbd-networks-new-step4-advanced.png)    ![Network wizard: step 4, advanced with TLS](https://www.agilicus.com/www/c5843b58-networks-new-step4-advanced-tls.png)    \#### Step 5: Apply

1. Review the summary, which restates the connector, network name, hostname, port and any advanced options. Select **APPLY** to create the network. Creation runs asynchronously; the wizard advances to Done automatically when it succeeds.

![Network wizard: step 5, apply](https://www.agilicus.com/www/4ae0d78f-networks-new-step5-apply.png)    \#### Step 6: Done

1. The Done step confirms the network was created and offers to add it to resource groups, assign permissions, and add it to policies.

![Network wizard: step 6, done](https://www.agilicus.com/www/c6e5ac57-networks-new-step6-done.png)    ### Adding networks from a CSV file

1. Select **ADD MULTIPLE FROM CSV** on the overview to open the **Add Multiple Networks Via CSV** dialog. It has three steps: select the connector, select a resource group to add the networks to, and upload a CSV file with the network definitions.

![Network CSV dialog](https://www.agilicus.com/www/5294da4e-networks-csv-dialog.png)    ![Network CSV dialog with connector selected](https://www.agilicus.com/www/b9cf50b4-networks-csv-dialog-connector.png)    ## How network access flows

```
%%{init: {"theme": "base", "themeVariables": {"background": "#ffffff", "primaryColor": "#e8f1fb", "primaryBorderColor": "#1f4e79", "primaryTextColor": "#111111", "lineColor": "#4a4a4a", "secondaryColor": "#f5f5f5", "fontFamily": "Inter, sans-serif"}} }%%
flowchart TD
    W["Workload running on the platform"]
    W -->|connects to network resource| AP["Identity-aware proxy / workload firewall"]
    AP -->|outbound-only tunnel| C["Connector at your site"]
    C --> S["Internal service<br/>hostname or IP : port"]
    S -->|TLS / protocol rules| AP
    AP -->|authorised response| W
```

The workload firewall sits between the workload and the connector. It applies your policies and, when diagnostic mode is enabled, records the traffic it forwards. See [Zero trust architecture](/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/zero-trust-architecture/) for the full theory.

## Fields and controls reference

| Control | Purpose | Required | Default | Valid values | Notes |
|---|---|---|---|---|---|
| Name | The network's unique name | Yes | n/a | A valid hostname, no spaces | Identifies the network in the organisation |
| Hostname or IP | The address of the service | Yes | n/a | Hostname or IP |  |
| Ports | Port or port range of the service | Yes | n/a | For example 80, or 80, 1000-2000 |  |
| Protocol | Transport protocol | Yes | TCP | TCP, UDP |  |
| External Forwarding | Send data out to the internet from the cloud | No | Off | On, Off | On the connector step |
| Override IP | Replace the destination IP | No | n/a | An IP address | Advanced configuration |
| Uses TLS | The service is reached with TLS | No | Off | On, Off | Advanced configuration |
| Verifies TLS | Verify the service's certificate | No | Off | On, Off | Advanced configuration |
| Expose as hostname | Expose the network as a TLS endpoint | No | Off | On, Off | Advanced configuration |
| Dynamic source port override | Launchers allocate the listening port | No | Off | On, Off | Advanced configuration |
| Source port override | Source port used when connecting | No | n/a | A port number | Advanced configuration |
| Source address override | Source address used when connecting | No | n/a | An IP address | Advanced configuration |
| Diagnostic mode | Whether traffic is logged | No | Off | On, Off | Toggled from the row menu |

## Dialogs and popups

- **Add Multiple Networks Via CSV dialog**: opened from **ADD MULTIPLE FROM CSV**. It collects the connector, an optional resource group, and a CSV upload, then provisions all the networks in the file.
- **Configure Policies dialog**: the two-pane policy assignment dialog shared by all resources. See [Policies](/anyx-guide/agilicus-anyx-administrative-web-interface/access/policies/).
- **Confirmation dialog**: deleting networks confirms before acting.

## Configuration versus diagnostics versus confirmation

- **Configuration**: creating networks, inline edits, advanced options, external forwarding, and CSV imports are persistent configuration.
- **Diagnostics**: diagnostic mode logs workload firewall traffic for troubleshooting; the overview row reflects the current state. Use **Search in Audits** from the row menu to inspect access attempts.
- **Confirmation**: deleting a network is permanent and removes it from the workloads that depend on it. Confirm before proceeding.

## Pagination and async behaviour

- The Networks overview pages at **25 rows per page**; the paginator shows the current page and totals. The demo organisation had 51 networks when captured, spanning three pages (25 + 25 + 1).
- Network creation runs asynchronously. After selecting **APPLY**, wait a few seconds; the wizard advances to Done automatically. New networks appear on the overview shortly after creation.
- Inline cell edits save when you blur the field; wait a few seconds and reload to confirm the change.
- Changes to diagnostic mode apply shortly after you select the row action; reload to confirm.

## Troubleshooting

- **The network will not create**: check the name is a valid hostname, the hostname or IP and ports are present, and a connector is selected. Validation errors appear on the relevant step.
- **A workload cannot reach the network**: check the connector status on the [Connectors](/anyx-guide/agilicus-anyx-administrative-web-interface/resources/connectors/) overview, confirm the hostname or IP and ports are correct, and confirm the workload's policies do not block the connection.
- **TLS connections fail**: confirm whether the service uses TLS and whether verification is appropriate. If the service presents a self-signed certificate, leave **verifies TLS** off.
- **Diagnostic mode shows unexpected traffic**: use the audit subsystem to trace the requests, and adjust policies accordingly.

## See also

- [Resources (concepts)](/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/resources/)
- [Zero trust architecture](/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/zero-trust-architecture/)
- [End-user experience](/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/end-user-experience/)
- [Resource permissions](/anyx-guide/agilicus-anyx-administrative-web-interface/access/resource-permissions/)
- [Resource groups](/anyx-guide/agilicus-anyx-administrative-web-interface/access/resource-groups/)
- [Policies](/anyx-guide/agilicus-anyx-administrative-web-interface/access/policies/)
- [Connectors](/anyx-guide/agilicus-anyx-administrative-web-interface/resources/connectors/) (including forwarding services)
- [Databases](/anyx-guide/agilicus-anyx-administrative-web-interface/resources/databases/)
- [Launchers](/anyx-guide/agilicus-anyx-administrative-web-interface/resources/launchers/)
- [Getting started: expose a resource](/anyx-guide/agilicus-anyx-administrative-web-interface/getting-started/expose-resource/)

## Web guide

- [Network](https://www.agilicus.com/product-guide/network)
- [Network resources on agilicus.com](https://www.agilicus.com/network)
- [Forwarding](https://www.agilicus.com/product-guide/forwarding)