# Connectivity requirements

## Overview <a href="#connectivityrequirements-overview" id="connectivityrequirements-overview"></a>

This page shows the connectivity requirements of every Nexthink product. If you operate in a restricted environment, your network administrator must add the domains on this page to an allowlist.

Some Nexthink products allow you to use a secure or a non-secure channel for specific services. Depending on their configuration, you may need to allow connections through a port number that is different from what is shown here.

Your Nexthink URL pattern can be one of the following:

* `<instance>.<region>.nexthink.cloud`
* `<instance>.data.<region>.nexthink.cloud`

URL pattern description:

* `<instance>` - The name of the Nexthink instance.
* `<region>` - The name of the localization of the instance:
  * `us` - United States.
  * `eu` - European Union.
  * `pac` - Asia-Pacific region.
  * `meta` - Middle East, Turkey, and Africa.

{% hint style="info" %}
Ensure your firewall has TCP port 443 open for your Nexthink instance URL.
{% endhint %}

The following tables indicate the transport protocol for each connection. When an application protocol handles the connection over the transport layer, the application protocol name precedes the transport protocol name.

## Web interface <a href="#connectivityrequirements-webinterface" id="connectivityrequirements-webinterface"></a>

<table data-full-width="true"><thead><tr><th>Port number</th><th>Protocol</th><th>Direction</th><th>Source</th><th>Reason</th><th>Domain</th><th>API base URL</th></tr></thead><tbody><tr><td>443</td><td>HTTPS / TCP</td><td>OUT</td><td>Nexthink administrator device (browser)</td><td>Access to the Nexthink web inteface</td><td>Nexthink instance Fully Qualified Domain Name (FQDN) link pattern:<br><code>&#x3C;instance>.&#x3C;region>.nexthink.cloud</code></td><td><code>https://instance.api.region.nexthink.cloud</code></td></tr><tr><td>443</td><td>HTTPS / TCP</td><td>OUT</td><td>Nexthink administrator device (browser)</td><td>Access to the Nexthink web interface with SAML-based authentication</td><td>Nexthink instance FQDN link pattern:<br><code>https://&#x3C;instance>-login.&#x3C;region>.nexthink.cloud</code></td><td>–</td></tr><tr><td>443</td><td>HTTPS / TCP</td><td>OUT</td><td>Nexthink administrator device (browser)</td><td>Access to the Nexthink web interface for the authentication</td><td><ul><li><code>*.okta.com</code></li><li><code>*.oktacdn.com</code></li></ul></td><td>–</td></tr><tr><td>443</td><td>WebSocket / TCP</td><td>IN/OUT<br><br>(Bidirectional)</td><td>Nexthink administrator device (browser)<br>or<br>Nexthink Cloud (backend services)</td><td>Real-time communication between frontend and backend.<br><br>Blocking this connection could impair features in Nexthink Assist and Nexthink Adopt.</td><td><code>events-&#x3C;region>-&#x3C;cluster>.&#x3C;continent-id>.nexthink.cloud</code><br><br>For example: <code>events-ap-northeast-1-main.pac.nexthink.cloud.</code></td><td>-</td></tr></tbody></table>

{% hint style="warning" %}
**WebSocket** communication is only applicable to standard Nexthink environments. FedRAMP-compliant [infinity-for-government](https://docs.nexthink.com/platform/security/infinity-for-government "mention") environments are not impacted by this requirement.
{% endhint %}

## Telemetry and monitoring <a href="#telemetry-and-monitoring" id="telemetry-and-monitoring"></a>

<table data-full-width="true"><thead><tr><th width="151">Port number</th><th width="150">Protocol</th><th width="100">Direction</th><th>Source</th><th width="305">Reason</th><th>Domain</th></tr></thead><tbody><tr><td>443</td><td>HTTPS / TCP</td><td>OUT</td><td>Nexthink Cloud (backend services)</td><td>Access to Datadog Real User Monitoring; for more information on data processing, see the <a href="https://docs.nexthink.com/legal/global-privacy-hub/nexthink-data-processing-schedule">Nexthink Data Processing Schedule</a></td><td><code>browser-intake-datadoghq.com</code></td></tr><tr><td>443</td><td>HTTPS / TCP</td><td>OUT</td><td>Nexthink Cloud (backend services)</td><td>Access to Pendo telemetry</td><td><ul><li><code>content.insights.nexthink.com</code></li><li><code>data.insights.nexthink.com</code></li></ul></td></tr></tbody></table>

## Collector <a href="#connectivityrequirements-collector" id="connectivityrequirements-collector"></a>

<table data-full-width="true"><thead><tr><th width="147">Port number</th><th width="237">Protocol</th><th width="115">Direction</th><th>Source</th><th>Reason</th></tr></thead><tbody><tr><td>443</td><td>WebSocket / TCP / HTTPS</td><td>OUT</td><td>End-user device with Collector.</td><td>Default communication channel to reach a Nexthink instance.</td></tr></tbody></table>

### Daily API call

Windows Collector calls a Windows API method once every 24 hours. The API method triggers a connection for the client to the domain controller operations through TCP port 135. Service responses use ephemeral TCP ports in the 49152—65535 range.

### Automatic update URL

Collector downloads installers for automatic updates to enhance reliability and performance. For this purpose, ensure the following URL is accessible under your organization’s network policies and firewall configurations:

`global.nexthink.cloud`

## Nexthink Mobile

<table data-full-width="true"><thead><tr><th>Port number</th><th>Protocol</th><th>Direction</th><th>Source</th><th>Reason</th></tr></thead><tbody><tr><td>443</td><td>HTTPS</td><td>OUT</td><td>End-user device running Nexthink App.</td><td>Default communication channel to reach a Nexthink instance.</td></tr><tr><td>443/80</td><td>HTTPS/HTTP</td><td>OUT</td><td>End-user device running Nexthink App.</td><td>Access to Firebase telemetry</td></tr></tbody></table>

## Data export <a href="#connectivityrequirements-dataexportlinks-thresholdsandurlpattern" id="connectivityrequirements-dataexportlinks-thresholdsandurlpattern"></a>

Nexthink users can export the results of their investigations using the export function. Each user can perform one export at a time. Multiple users of the same Nexthink instance can run a maximum of five exports in parallel.

The data export generates a link to an export file. This is a pre-signed link to an Amazon Web Services (AWS) S3 bucket, which is valid for 10 minutes. The link uses Amazon virtual-hosted-style. See the following example to understand the link structure:

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2Fgit-blob-3642aeb21359e850775bd537eb2ab80090e8781a%2Fdata_export_link_structure.png?alt=media" alt="Data export link structure"><figcaption></figcaption></figure>

You should add this URL to the allowlist of your firewall.

<details>

<summary>How do I determine the URL for my organization's AWS S3 bucket?</summary>

From **Investigations** in the Nexthink web interface:

1. Create or run any investigation query.
2. **Export results** from the top-right corner.
3. Check the link provided by Nexthink to download the CSV file. This is the URL you should add to the allowlist of your firewall.

In the example below, the URL is `https://aris-export-us-east-2-884848470805.s3.us-east-2.amazonaws.com`

<figure><img src="https://268444917-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxJSUDk9NTtCHYPG5EWs3%2Fuploads%2FtpHs7SNbkzyuedSu9Gq6%2Fimage.png?alt=media&#x26;token=7a85deea-46e2-49bf-8b43-260ed4bf4db8" alt=""><figcaption></figcaption></figure>

Alternatively, you can also create the URL using the structure `https://nxc-ch-data-export-884848470805-<region>-<cluster>.s3.<region>.amazonaws.com`.

* Change `<region>` , in both places, to the region of your tenant. For example: `eu-west-2`&#x20;
* If your environment is in a region with multiple clusters—which is determined by Nexthink according to technical requirements—change `<cluster>` with the cluster of your tenant. For example: `main`, `a`, `b`, etc.

{% hint style="warning" %}
For single-cluster regions, you do not need to add/replace the `<cluster>` within the URL.&#x20;
{% endhint %}

</details>

## Documentation platform

Add the following domains to an allowlist to enable browsing the [Nexthink documentation](https://docs.nexthink.com/) in virtual desktop environments (VDIs).

<table><thead><tr><th width="224">Domain</th><th width="110">Protocol</th><th>Description</th></tr></thead><tbody><tr><td><code>*.fontawesome.com</code></td><td>HTTPS</td><td>Font Awesome icon library</td></tr><tr><td><code>*.gitbook.com</code></td><td>HTTPS</td><td>GitBook documentation platform</td></tr><tr><td><code>*.gitbook.io</code></td><td>HTTPS</td><td>GitBook documentation platform</td></tr><tr><td><code>*.iframe.ly</code></td><td>HTTPS</td><td>Iframely content delivery network (CDN)</td></tr><tr><td><code>*.jsdelivr.net</code></td><td>HTTPS</td><td>jsDelivr CDN</td></tr><tr><td><code>*.mux.com</code></td><td>HTTPS</td><td>Mux video streaming infrastructure</td></tr><tr><td><code>*.nexthink.com</code></td><td>HTTPS</td><td>Nexthink documentation platform</td></tr><tr><td><code>*.okta.com</code></td><td>HTTPS</td><td>Okta identity and access management</td></tr><tr><td><code>*.synthesia.io</code></td><td>HTTPS</td><td>Synthesia video streaming platform</td></tr></tbody></table>

## Data Enricher (classic) <a href="#connectivityrequirements-dataenricher-classic" id="connectivityrequirements-dataenricher-classic"></a>

<table data-full-width="true"><thead><tr><th width="149">Port number</th><th width="141">Protocol</th><th width="111">Direction</th><th>Reason</th><th>Domain</th></tr></thead><tbody><tr><td>53</td><td>DNS / UDP</td><td>OUT</td><td>Resolving destination names by reverse IP</td><td>–</td></tr><tr><td>389</td><td>LDAP / TCP</td><td>OUT</td><td>Connection to Active Directory (AD); non-secure</td><td>–</td></tr><tr><td>443</td><td>HTTPS / TCP</td><td>OUT</td><td>Send AD and DNS data</td><td><code>agora.&#x3C;region>.nexthink.cloud</code><br><br>Replace <code>&#x3C;region></code> with the <a href="../../bringing-data-into-your-nexthink-instance/integrating-nexthink-with-third-party-tools/api-and-integrations-classic/data-enricher-classic/general-configuration-file-classic">availability region of the customer</a></td></tr><tr><td>636</td><td>LDAPS / TCP</td><td>OUT</td><td>Connection to AD; secure</td><td>–</td></tr></tbody></table>

## Finder (classic) <a href="#connectivityrequirements-finder-classic" id="connectivityrequirements-finder-classic"></a>

{% hint style="info" %}
Nexthink Finder is a Windows-only desktop application. Its functionality is available within the Nexthink web interface. Nexthink can now be used directly from a browser, and most functions no longer require an additional desktop application.
{% endhint %}

<table data-full-width="true"><thead><tr><th width="140">Port number</th><th width="160">Protocol</th><th width="111">Direction</th><th width="396">Reason</th><th>Domain</th></tr></thead><tbody><tr><td>25</td><td>SMTP / TCP</td><td>OUT</td><td>Send email in case of errors</td><td>–</td></tr><tr><td>80</td><td>HTTP / TCP</td><td>OUT</td><td>Connection to the documentation website</td><td><code>doc.nexthink.com</code></td></tr><tr><td>80</td><td>HTTP / TCP</td><td>OUT</td><td>Verification of security certificates</td><td><code>ocsp.verisign.com</code></td></tr><tr><td>443</td><td>HTTPS / TCP</td><td>OUT</td><td>Connection to the documentation website</td><td><ul><li><code>doc.nexthink.com</code></li><li><code>docs.nexthink.com</code></li></ul></td></tr><tr><td>443</td><td>WebSocket / TCP</td><td>OUT</td><td>User connection to the web interface</td><td>Nexthink instance FQDN</td></tr><tr><td>443</td><td>HTTPS / TCP</td><td>OUT</td><td>Application installation and software updates</td><td>Nexthink instance FQDN</td></tr><tr><td>443</td><td>HTTPS / TCP</td><td>OUT</td><td>Support telemetry</td><td><code>alib.nexthink.com</code></td></tr><tr><td>443</td><td>HTTPS / TCP</td><td>OUT</td><td>Connection to Nexthink Library</td><td><code>library.nexthink.com</code></td></tr></tbody></table>

## Engine (classic) <a href="#connectivityrequirements-engine-classic" id="connectivityrequirements-engine-classic"></a>

{% hint style="info" %}
If rule-based Collector assignment is turned on, the TCP channel of Collector also connects to the Nexthink web interface. Collectors use this connection to ask for their assigned Engine (classic). Collector can no longer use a UDP channel to send end-user analytics to the Engine (classic).
{% endhint %}

<table data-full-width="true"><thead><tr><th width="150">Port number</th><th width="94">Protocol</th><th width="114">Direction</th><th>Reason</th></tr></thead><tbody><tr><td>443</td><td>TCP</td><td>OUT</td><td>Send end-user analytics to the Engine (classic); coordination data and updates</td></tr></tbody></table>