2.1 ActiveGate Types: Environment vs. Cluster ActiveGates

2.1 ActiveGate Types: Environment vs. Cluster ActiveGates

In enterprise observability architectures, monitored hosts frequently operate within isolated subnets, private cloud virtual private clouds (VPCs), or demilitarized zones (DMZs) that lack direct outbound internet connectivity. Establishing direct outbound communication from thousands of individual servers to the Dynatrace platform introduces severe security risks, firewall rule sprawl, and substantial wide area network (WAN) bandwidth consumption. The Dynatrace ActiveGate solves these architectural challenges by serving as an intelligent secure proxy, telemetry aggregator, message router, and remote execution engine.

Understanding the distinction between Environment ActiveGates (EAG) and Cluster ActiveGates (CAG), their network communication semantics, port configurations, and high-availability topologies is a primary competency assessed on the Dynatrace Certified Associate exam.

---

Architectural Role of Dynatrace ActiveGate

An ActiveGate is not a generic forward or reverse proxy; it is a specialized Dynatrace software component engineered to optimize and secure communication between monitored entities and the Dynatrace processing backend (whether Dynatrace SaaS or Dynatrace Managed). ActiveGates fulfill several foundational architectural requirements:

1. WAN Bandwidth Optimization & Data Compression: When hundreds or thousands of OneAgents transmit high-frequency metrics, PurePath distributed trace spans, metadata, and topology events, routing this unaggregated stream directly over internet or inter-datacenter links creates network bottlenecks. ActiveGates bundle, compress, and micro-batch telemetry before transmitting it upstream, reducing WAN bandwidth utilization by up to 70%.
2. Firewall & Security Boundary Consolidation: Instead of opening outbound firewall pinholes on TCP port 443 for every individual monitored host in a private subnet, network administrators only open a single outbound path from the ActiveGate to Dynatrace. Monitored hosts only require local network access to the ActiveGate.
3. Offloading Heavy Diagnostic Workloads: High-volume diagnostic tasks, such as process memory dumps (heap dumps and thread dumps), generate multi-gigabyte files. ActiveGates store these diagnostic artifacts locally on disk, preventing production application hosts from saturating their network interfaces when exporting diagnostics to administrators.
4. Remote Polling & Private Integrations: ActiveGates host background execution engines that collect data from systems where OneAgent cannot be installed directly, such as VMware vCenter APIs, cloud provider monitoring APIs (AWS CloudWatch, Azure Monitor, Google Cloud Operations), network devices (SNMP), and private synthetic monitoring tests.

---

Environment ActiveGate (EAG)

An Environment ActiveGate is strictly bound to a single Dynatrace environment (tenant). It is identified and authenticated using that specific environment's unique tenant identifier and environment token.

Scope and Availability

Environment ActiveGates are deployed in both Dynatrace SaaS and Dynatrace Managed deployments. Because Dynatrace SaaS is multi-tenant by nature at the cloud infrastructure tier, any ActiveGate deployed by a customer within their on-premise datacenter or cloud VPC to communicate with a SaaS tenant is, by definition, an Environment ActiveGate.

Primary Responsibilities of an Environment ActiveGate

• OneAgent Traffic Proxying & Aggregation: Ingests HTTPS traffic from local OneAgents, aggregates traces and metrics, and forwards them to the tenant.
• Local Memory Dump Storage: Acts as the local repository for Java, .NET, and Node.js memory dumps, holding large binary dumps on local disk for analysis.
• Private Synthetic Execution: Executes single-step HTTP monitors, multi-step HTTP monitors, and full headless browser synthetic clickpaths targeting internal web applications inaccessible from the public internet.
• Cloud & Virtualization API Polling: Connects directly to local hypervisors (VMware vCenter/ESXi) and cloud endpoints (AWS, Azure, GCP) to collect infrastructure metrics agentlessly.
• Extensions 2.0 Controller: Hosts the Extension Execution Controller (EEC) to run SNMP polling, Prometheus scraping, WMI queries, and database (SQL/JDBC) extensions.
• Telemetry Ingestion Gateway: Receives OpenTelemetry (OTLP via HTTP/gRPC), AWS CloudWatch metric streams, and remote syslog streams.

---

Cluster ActiveGate (CAG)

A Cluster ActiveGate is bound to an entire Dynatrace Managed cluster rather than an individual environment. It operates at the cluster management level and is capable of servicing multiple distinct environments hosted on that Managed cluster.

Scope and Exclusivity to Dynatrace Managed

Cluster ActiveGates are exclusively available for Dynatrace Managed deployments. They do not exist in Dynatrace SaaS architectures because Dynatrace manages the cluster infrastructure, ingress load balancers, and multi-tenant routing layers in SaaS.

In a Dynatrace Managed deployment, an organization may host dozens of isolated environments (e.g., development, staging, production, or distinct business units). Rather than placing individual Environment ActiveGates for every tenant inside a shared perimeter network or DMZ, the organization deploys a pool of Cluster ActiveGates in the DMZ.

Primary Responsibilities of a Cluster ActiveGate

• Multi-Tenant Telemetry Routing: Accepts connections from OneAgents and Environment ActiveGates belonging to any tenant hosted on the Managed cluster, multiplexing and routing the traffic to the appropriate backend cluster nodes.
• Perimeter / DMZ Gateway: Acts as a secure consolidation point between untrusted or semi-trusted external networks and the internal cluster nodes, preventing external clients from communicating directly with the core cluster database or server processes.
• Web UI & REST API Routing: Serves as a secure access gateway for users accessing the Dynatrace Managed web interface or executing REST API calls from outside the internal network.
• Cluster-Wide Updates: Coordinates software package caching and update distribution for OneAgents across the cluster.

[!IMPORTANT] A Cluster ActiveGate cannot execute Private Synthetic monitors or host tenant-specific Extensions 2.0. Those capabilities require single-tenant context, dedicated credentials, and tenant-specific execution controllers, meaning they must always be run on an Environment ActiveGate.

---

Architectural Comparison: EAG vs. CAG

The following table summarizes the key operational differences evaluated on the certification exam:

---

Network Ports, Communication Flow & Security

Dynatrace ActiveGate adheres to a strict unidirectional connection philosophy designed to satisfy rigorous corporate network security standards.

Port Architecture Matrix

• Inbound TCP Port 9999 (Default): The ActiveGate listens on port 9999 for incoming HTTPS traffic from OneAgents, child ActiveGates, and REST API clients. This port is configurable via the dnsEntryPoint or port configuration settings in custom.properties.
• Outbound TCP Port 443: The ActiveGate initiates an outbound HTTPS connection to the Dynatrace SaaS environment (https://<environment-id>.live.dynatrace.com:443) or to the Dynatrace Managed cluster nodes.
• Outbound TCP Port 8443 / 9999 (Managed Only): When forwarding to Dynatrace Managed cluster nodes, communication occurs over port 443 or cluster-configured communication ports.

Unidirectional Communication Rule

A critical concept for the associate exam is the directionality of network connections:

• OneAgent to ActiveGate: OneAgent initiates the outbound connection to the ActiveGate on port 9999. The ActiveGate never initiates an inbound connection back to OneAgent.
• ActiveGate to Dynatrace Cluster: The ActiveGate initiates the outbound connection to the Dynatrace Cluster on port 443. The Dynatrace Cluster (SaaS or Managed) never initiates an inbound connection to the ActiveGate.
• Zero Inbound Firewall Openings: Firewalls protecting private subnets containing monitored hosts require zero inbound ports open from the internet or external tiers. All communication flows outbound from inner trust zones to outer trust zones.

[Monitored Host: OneAgent]
       │
       │ Outbound TCP 9999 (HTTPS)
       ▼
[Environment ActiveGate]
       │
       │ Outbound TCP 443 (HTTPS)
       ▼
[Dynatrace SaaS / Managed Cluster]

Mutual TLS and Certificate Handling

All traffic passing through an ActiveGate is encrypted using TLS 1.2 or TLS 1.3. ActiveGates generate self-signed certificates by default for local OneAgent-to-ActiveGate communication. However, enterprise environments can install custom, CA-signed SSL/TLS certificates on the ActiveGate to comply with internal public key infrastructure (PKI) standards. OneAgents validate these certificates against their internal trust store or system trust store.

---

High Availability, Load Balancing & Sizing

Dynamic Active-Active Architecture

Dynatrace ActiveGates operate in an active-active, self-load-balancing topology without requiring a dedicated third-party hardware or software load balancer:

1. When multiple ActiveGates are deployed in an environment, the Dynatrace cluster maintains an active catalog of their health, status, and IP endpoints.
2. The cluster continuously distributes this prioritized list of available ActiveGate endpoints to all connected OneAgents during routine polling.
3. OneAgents distribute their connections across the available ActiveGates. If a connected ActiveGate experiences a hardware failure, network outage, or service restart, the OneAgent automatically reconnects to the next available ActiveGate in its cached list without metric loss.
4. When is an External Load Balancer Used? External load balancers (F5, AWS ALB/NLB) are optional for OneAgent routing. However, an external load balancer or virtual IP (VIP) is commonly utilized when ActiveGates serve as fixed target endpoints for third-party metric emitters, such as AWS CloudWatch Kinesis Firehose streams or OpenTelemetry collectors that require a single static DNS entry point.

Sizing and Hardware Specifications

Hardware requirements for ActiveGate instances scale according to the number of connected OneAgents and enabled capabilities:

• Small Installation (Up to 100 OneAgents): 2 to 4 vCPUs, 4 to 8 GB RAM, 30 GB available disk space.
• Medium Installation (100 to 1,000 OneAgents): 4 to 8 vCPUs, 8 to 16 GB RAM, 50 to 100 GB available disk space (SSD recommended for spooling).
• Large Installation (1,000+ OneAgents): 8 to 16 vCPUs, 16 to 32 GB RAM, 100+ GB available SSD storage.
• Operating System Support: Linux (Red Hat Enterprise Linux 8/9, Rocky Linux, AlmaLinux, CentOS, SUSE Linux Enterprise Server 12/15, Debian 10/11/12, Ubuntu LTS 20.04/22.04/24.04) and Windows Server (2016, 2019, 2022).