Firewall and egress requirements
The collector is outbound-only. What to allow, on which ports, and why no inbound rules are ever needed.
Overview
The AssurIQ collector is an outbound-only agent. It initiates every connection to the AssurIQ control plane over HTTPS/mTLS on port 443; the control plane never opens a connection back to the collector. No inbound firewall rules, port forwards or NAT exceptions are required or supported.
Required endpoints
| Purpose | Direction | Port | Notes |
|---|---|---|---|
| Enrollment and heartbeat | Outbound only | 443/TCP | mTLS to the control plane |
| Evidence and scan result upload | Outbound only | 443/TCP | Same control-plane endpoint |
| Installer and binary download | Outbound only | 443/TCP | One-time, during install or upgrade |
| Auto-upgrade channel | Outbound only | 443/TCP | Periodic check-in |
Allow-list the control plane URL you were given during onboarding at the firewall or web filter level, by hostname where the filtering device supports SNI-based rules, so a future IP change does not break connectivity.
TLS inspection and content filtering
If your organization enforces TLS inspection broadly, add an explicit bypass for the AssurIQ control plane hostname.
DNS and clock requirements
- The host must be able to resolve the control plane hostname via DNS.
- The host clock must be accurate; the platform tolerates up to 5 seconds of skew before heartbeat and mTLS validation are affected.
- NTP synchronization is strongly recommended on every collector host.
Proxy environments
If outbound traffic must transit an explicit or PAC-defined proxy, configure the collector's proxy settings during or after install rather than relying on system-wide defaults, since the collector runs as a service account that may not read a logged-in user's proxy configuration.
Troubleshooting
A collector that cannot reach the control plane will show Offline once its heartbeat grace period elapses, or Enrollment Pending if it never completed its first exchange.
- AIQ-COL-001Collector offlineThe collector has not sent a heartbeat within the expected interval. Discovery, scans and evidence collection for its sites are paused.
- AIQ-ENR-004Control plane unreachable during enrollmentThe host could not complete the outbound HTTPS/mTLS handshake to the control plane.