2.3 Network Zones, Multi-DC Routing & Firewall Traversal

2.3 Network Zones, Multi-DC Routing & Firewall Traversal

Enterprise computing infrastructures are rarely homogeneous or flat. Organizations routinely operate hybrid cloud networks comprising multiple public cloud regions (e.g., AWS us-east-1, Azure West Europe), geographically distributed on-premise datacenters, and secure computing enclaves such as PCI-DSS payment zones or HIPAA data repositories.

Without intelligent routing governance, monitoring agents in an AWS VPC could randomly connect to an on-premise ActiveGate over an expensive DirectConnect circuit, incurring significant egress costs and high network latency. Dynatrace Network Zones and ActiveGate Chaining provide the architectural controls necessary to manage multi-datacenter routing, enforce traffic locality, and securely traverse complex enterprise firewalls.

---

Network Zones: Architecture and Purpose

A Network Zone is a user-defined, case-sensitive string identifier (such as aws-us-east-1, datacenter-frankfurt, or pci-enclave) assigned to OneAgents and ActiveGates. Network Zones enforce the following operational principles:

1. Data Locality: Ensuring that telemetry generated by OneAgents in a specific datacenter or cloud region stays within that physical or logical boundary by routing exclusively through local ActiveGates.
2. WAN & Cloud Egress Cost Reduction: Eliminating cross-region or cloud-to-on-premise data egress fees by preventing agents from communicating across expensive network links when local gateways exist.
3. Latency Optimization: Reducing round-trip connection overhead for high-frequency distributed tracing and metric streaming by ensuring OneAgents connect to geographically adjacent gateways.
4. Compliance & Isolation: Enforcing that monitored systems inside regulated subnets route their data strictly through designated gateways that meet specific auditing or encryption standards.

---

OneAgent Endpoint Selection & Routing Algorithm

When a OneAgent initializes or establishes a new connection, it determines which ActiveGate to connect to by executing a deterministic, prioritized routing algorithm:

[Step 1: Check Assigned Network Zone]
Are any healthy ActiveGates available in the OneAgent's assigned Network Zone?
       │
       ├─► YES: Randomly connect to a healthy ActiveGate in this zone (load balanced).
       ▼ NO
[Step 2: Check Configured Fallback Zones]
Is a fallback zone configured (e.g., fallback = "dc-backup")?
       │
       ├─► YES: Connect to a healthy ActiveGate in the fallback zone.
       ▼ NO
[Step 3: Check Default Zone / Direct Cluster Access]
Is fallback to the default (empty) network zone permitted?
       │
       ├─► YES: Connect to an ActiveGate without an assigned zone, or connect
       │        directly to the Dynatrace Cluster if network routing allows.
       ▼ NO
[Step 4: Local Buffering / Spooling]
Buffer telemetry locally in host memory and disk; retry Step 1 periodically.

The Priority Hierarchy in Detail

1. Priority 1 — ActiveGates in the Same Network Zone: The OneAgent queries its cluster-provided endpoint list and filters for ActiveGates sharing its exact, assigned Network Zone name. If multiple ActiveGates exist in the zone, OneAgent balances its traffic across them.
2. Priority 2 — ActiveGates in Fallback Network Zones: If all ActiveGates in the primary zone become unreachable (due to host crashes, maintenance, or network partition), OneAgent looks for ActiveGates in configured fallback zones (defined as a comma-separated priority list).
3. Priority 3 — Default Zone ActiveGates & Direct Cluster Connection: If no fallback zone is defined and general fallback is permitted, OneAgent attempts to connect to ActiveGates that have no network zone assigned (the default zone) or attempts direct communication with the Dynatrace Cluster (SaaS or Managed) over port 443.
4. Strict Isolation (Fallback Disabled): In highly secure environments, administrators can disable network zone fallback entirely. When fallback is disabled and all local ActiveGates become unavailable, OneAgent refuses to route data across alternative networks. It spools metrics and traces locally in host memory and disk cache, continuously retrying the local ActiveGates until they recover.

Automatic Recovery and Reversion

OneAgent failover is fully dynamic. Even when a OneAgent is actively connected to a fallback zone ActiveGate, it continues to probe the status of its primary local Network Zone endpoints in the background. As soon as a local ActiveGate recovers, OneAgent seamlessly switches its active connection back to the primary zone, preserving optimal network performance without administrator intervention.

---

Configuring Network Zones Across the Enterprise

Network Zones must be declared on both the ActiveGates and the monitored OneAgent hosts.

Configuring the Network Zone on an ActiveGate

On the ActiveGate host, edit custom.properties:

[network_zone]
networkZone = aws-us-east-1

Restart the ActiveGate service (systemctl restart dynatracegateway) to register the zone with the Dynatrace cluster.

Configuring the Network Zone on OneAgent

OneAgents can be assigned a Network Zone using three distinct methods:

1. At Installation Time (Installer Flag):

   # Linux
   /bin/sh Dynatrace-OneAgent-Linux.sh --set-network-zone=aws-us-east-1
   
   # Windows
   Dynatrace-OneAgent-Windows.exe --set-network-zone=aws-us-east-1
   

2. Post-Installation via oneagentctl CLI:

   # Set the network zone
   ./oneagentctl --set-network-zone=aws-us-east-1
   
   # Verify the active network zone
   ./oneagentctl --get-network-zone
   
   # Inspect current active endpoints received from cluster
   ./oneagentctl --get-activegate-endpoints
   

3. Centrally via the Dynatrace Web UI: Under Settings > Preferences > Network Zones, administrators can define global fallback rules and create automated assignment rules based on host metadata, host groups, or IP subnets.

---

Multi-Tier ActiveGate Chaining & DMZ Firewall Traversal

In banking, healthcare, government, and PCI-DSS compliant environments, backend servers (e.g., core database servers or payment transaction engines) are placed in deeply isolated enclaves with zero direct internet or perimeter access. Outbound connections are strictly limited to adjacent internal network segments.

Dynatrace solves this with Chained (Multi-Tier) ActiveGates, where one ActiveGate proxies through another ActiveGate before reaching Dynatrace.

Chained ActiveGate Communication Flow

[Internal Database Enclave]
  └─► OneAgent on Database Host
          │
          │ TCP 9999 (Local Subnet HTTPS)
          ▼
     [Tier 1: Internal Environment ActiveGate]
          │
          │ TCP 9999 (Internal Firewall Traversal)
          ▼
[DMZ / Perimeter Network]
     [Tier 2: Perimeter ActiveGate / CAG]
          │
          │ TCP 443 (Outbound Internet / Egress Proxy)
          ▼
[Dynatrace SaaS Core (*.live.dynatrace.com)]

Why This Satisfies Strict Firewall Policies

• Zero Inbound Openings: The database enclave firewall only allows outbound TCP port 9999 traffic to the internal ActiveGate IP. No traffic can ever enter the database enclave from the DMZ.
• No Direct Internet Routing: The internal ActiveGate cannot reach the internet; it only routes outbound TCP port 9999 traffic to the perimeter ActiveGate in the DMZ.
• IP Hiding & Consolidation: Upstream firewalls only need to permit outbound port 443 traffic from the perimeter ActiveGate IP to Dynatrace SaaS, completely hiding all internal database host IP addresses.

---

Corporate Forward Proxies & Authentication

In organizations where all outbound internet traffic must pass through an enterprise forward proxy (such as Squid, BlueCoat, Zscaler, or Cisco Web Security Appliance), ActiveGates can be configured to egress through the proxy.

ActiveGates support HTTP forward proxying with Anonymous, Basic, or NTLM authentication. The proxy parameters are defined in custom.properties:

[http.client.proxy]
host = corporate-proxy.internal.corp
port = 8080
user = dynatrace-egress-svc
password = EncryptedOrPlainPassword
exceptions = *.internal.corp;10.*.*.*

• The exceptions directive specifies internal IP ranges and hostnames that the ActiveGate must connect to directly without routing through the forward proxy (such as local OneAgents, child ActiveGates, or internal vCenter servers).

---

Enterprise Routing & Firewall Matrices

Network Zone Failover Decision Matrix

Firewall Port Traversal Matrix Across Tiers