Networks

The Networks pages (routes /network-overview and /network-new) manage global network resources. A network is a global resource, usually a TCP service such as an internal server or a database, available from your domain of control to applications running on the platform. The workload firewall gates access to these resources. See Resources (concepts) for where networks fit in the platform.

Purpose

A network resource names a service inside your private network (hostname or IP plus ports and protocol) and makes it reachable through the platform. Applications running on the platform, launchers, and other workloads connect to the network resource through the connector, and the workload firewall applies your access rules. Networks are the building block that forwarding services and connectors route on: the same network that a database or desktop resource uses can be exposed to workloads.

The Networks overview lists every network with its address, ports, protocol, connector and diagnostic mode, and lets you create, edit and delete networks, including creating several at once from a spreadsheet. The New Network wizard steps through the connector, name, address, advanced options, a review and a done step.

Why use it

Expose an internal TCP service (such as a database or an internal server) to applications running on the platform, with no inbound ports. See Zero trust architecture.
Make one network resource available to workloads and to forwarding services at other sites, without a virtual private network.
Control how the service is reached: TLS in either direction, hostname exposure, and dynamic source ports for launchers.
Provision many networks at once from a comma-separated values (CSV) file.

When to use it

When an application running on the platform needs to reach an internal service that is not itself an exposed application, database, SSH or desktop resource.
When a connector at another site needs access to a service at your site (see Forwarding services).
Whenever you add, change or remove a network, or change how the workload firewall reaches it.

Prerequisite: permission to administer networks (an owner or administrator role). Without it, the page shows a no permissions message.

How to use it

Networks overview

Open Resources > Networks > Overview from the left navigation.

The table lists every network with its name, hostname or IP, ports, protocol, override IP, connector, policies, diagnostic mode and an actions menu. The name, hostname, ports and override IP cells are editable inline.

Expand a network row (the chevron at the end of the row) to reveal its advanced options:

The expanded detail shows whether the network is accessed via TLS, verifies TLS, is exposed as a hostname, supports only HTTP/1.1, uses external forwarding, dynamically allocates the listening port, and any source port or source address overrides.

Use the toolbar buttons to ADD NETWORK, ADD MULTIPLE FROM CSV, or delete selected rows, and the search box to filter the table.

Open the more menu on a network row for the row actions:

Disable Diagnostic Mode (or Enable Diagnostic Mode): toggles the network’s diagnostic mode, which logs the traffic the workload firewall handles.
Search in Audits: jumps to the audit subsystem filtered to this network.
Configure Policies: attaches policies to the network.

Creating a network with the wizard

Open Resources > Networks > New. The wizard has six steps: Select connector, Network name, Address, Advanced Configuration (optional), Apply, and Done.

#### Step 1: Select connector

Choose the connector that fronts the network. If you have not created one, use Resources > Connectors > New first, then return and select it. Tick External Forwarding if the network should send data out to the internet from the Agilicus cloud rather than to a connector at your site.

#### Step 2: Network name

Enter the network name. The tooltip explains that this name must be a valid hostname and uniquely identifies the network within this organisation.

#### Step 3: Address

Enter the hostname or IP of the network, the ports (a port or a comma-separated list, for example 80, 443 or 1000-2000), and choose the protocol: TCP or UDP.

#### Step 4: Advanced Configuration (optional)

Choose whether the network has additional options. Choosing Yes reveals:

the override IP, which replaces the destination IP when the connector forwards the network;
My internal network service uses TLS: whether the service is reached with TLS;
My internal network service verifies TLS: whether to verify the service’s certificate;
My internal network service exposes the network as a TLS endpoint: whether the network is exposed to clients as a TLS endpoint;
My launchers dynamically allocate the listening port: whether launchers choose the listening port at run time;
the source port override and source address override, which change the source address and port the workload firewall uses when connecting.

#### Step 5: Apply

Review the summary, which restates the connector, network name, hostname, port and any advanced options. Select APPLY to create the network. Creation runs asynchronously; the wizard advances to Done automatically when it succeeds.

#### Step 6: Done

The Done step confirms the network was created and offers to add it to resource groups, assign permissions, and add it to policies.

Adding networks from a CSV file

Select ADD MULTIPLE FROM CSV on the overview to open the Add Multiple Networks Via CSV dialog. It has three steps: select the connector, select a resource group to add the networks to, and upload a CSV file with the network definitions.

How network access flows

%%{init: {"theme": "base", "themeVariables": {"background": "#ffffff", "primaryColor": "#e8f1fb", "primaryBorderColor": "#1f4e79", "primaryTextColor": "#111111", "lineColor": "#4a4a4a", "secondaryColor": "#f5f5f5", "fontFamily": "Inter, sans-serif"}} }%%
flowchart TD
    W["Workload running on the platform"]
    W -->|connects to network resource| AP["Identity-aware proxy / workload firewall"]
    AP -->|outbound-only tunnel| C["Connector at your site"]
    C --> S["Internal service<br/>hostname or IP : port"]
    S -->|TLS / protocol rules| AP
    AP -->|authorised response| W

The workload firewall sits between the workload and the connector. It applies your policies and, when diagnostic mode is enabled, records the traffic it forwards. See Zero trust architecture for the full theory.

Fields and controls reference

Control	Purpose	Required	Default	Valid values	Notes
Name	The network’s unique name	Yes	n/a	A valid hostname, no spaces	Identifies the network in the organisation
Hostname or IP	The address of the service	Yes	n/a	Hostname or IP
Ports	Port or port range of the service	Yes	n/a	For example 80, or 80, 1000-2000
Protocol	Transport protocol	Yes	TCP	TCP, UDP
External Forwarding	Send data out to the internet from the cloud	No	Off	On, Off	On the connector step
Override IP	Replace the destination IP	No	n/a	An IP address	Advanced configuration
Uses TLS	The service is reached with TLS	No	Off	On, Off	Advanced configuration
Verifies TLS	Verify the service’s certificate	No	Off	On, Off	Advanced configuration
Expose as hostname	Expose the network as a TLS endpoint	No	Off	On, Off	Advanced configuration
Dynamic source port override	Launchers allocate the listening port	No	Off	On, Off	Advanced configuration
Source port override	Source port used when connecting	No	n/a	A port number	Advanced configuration
Source address override	Source address used when connecting	No	n/a	An IP address	Advanced configuration
Diagnostic mode	Whether traffic is logged	No	Off	On, Off	Toggled from the row menu

Dialogs and popups

Add Multiple Networks Via CSV dialog: opened from ADD MULTIPLE FROM CSV. It collects the connector, an optional resource group, and a CSV upload, then provisions all the networks in the file.
Configure Policies dialog: the two-pane policy assignment dialog shared by all resources. See Policies.
Confirmation dialog: deleting networks confirms before acting.

Configuration versus diagnostics versus confirmation

Configuration: creating networks, inline edits, advanced options, external forwarding, and CSV imports are persistent configuration.
Diagnostics: diagnostic mode logs workload firewall traffic for troubleshooting; the overview row reflects the current state. Use Search in Audits from the row menu to inspect access attempts.
Confirmation: deleting a network is permanent and removes it from the workloads that depend on it. Confirm before proceeding.

Pagination and async behaviour

The Networks overview pages at 25 rows per page; the paginator shows the current page and totals. The demo organisation had 51 networks when captured, spanning three pages (25 + 25 + 1).
Network creation runs asynchronously. After selecting APPLY, wait a few seconds; the wizard advances to Done automatically. New networks appear on the overview shortly after creation.
Inline cell edits save when you blur the field; wait a few seconds and reload to confirm the change.
Changes to diagnostic mode apply shortly after you select the row action; reload to confirm.

Troubleshooting

The network will not create: check the name is a valid hostname, the hostname or IP and ports are present, and a connector is selected. Validation errors appear on the relevant step.
A workload cannot reach the network: check the connector status on the Connectors overview, confirm the hostname or IP and ports are correct, and confirm the workload’s policies do not block the connection.
TLS connections fail: confirm whether the service uses TLS and whether verification is appropriate. If the service presents a self-signed certificate, leave verifies TLS off.
Diagnostic mode shows unexpected traffic: use the audit subsystem to trace the requests, and adjust policies accordingly.