Skip to content

Network Requirements

SchemaDock needs two kinds of network access:

  1. outbound access from the SchemaDock host to the SchemAlign SchemaDock gateway
  2. private-network access from the SchemaDock host to the destinations pipelines need to reach

SchemAlign gateway connectivity

The SchemaDock agent initiates an outbound connection to the SchemAlign gateway over:

Protocol: TCP
Port:     443
Direction: outbound from the SchemaDock host

The configured gateway URL is specific to the SchemAlign environment, for example:

https://<customer-instance>.schemalign.com/schemadock

A normal SchemaDock deployment does not require an inbound Internet-facing port on the customer firewall.

Private destination connectivity

The SchemaDock host must be able to resolve and connect to each private destination that will be authorized.

Common destination ports include:

Destination type Typical port
SFTP / SSH 22
HTTPS 443
LDAPS 636
HTTP 80
Custom TCP service Configured destination port

These are examples, not forced defaults. Destination policy must match the actual host and port used by the pipeline.

DNS

If a destination is configured by hostname, the SchemaDock host must be able to resolve that hostname using the customer network's DNS configuration.

For internal DNS names, install SchemaDock on a host that has access to the required internal DNS resolvers and search domains.

Firewall model

A typical firewall model is:

SchemaDock host
    -> outbound TCP 443 to SchemAlign gateway
    -> outbound/private TCP to approved internal destinations

Internet
    -X-> no normal inbound SchemaDock listener required

Use destination policy in SchemAlign in addition to network firewall controls. Firewall reachability alone does not authorize a SchemaDock destination.

TLS and destination certificates

SchemaDock transports the original application TCP stream.

For HTTPS and LDAPS, certificate validation remains the responsibility of the originating node or connector. SchemaDock does not replace destination certificate verification with its own trust decision.

If a private HTTPS or LDAPS service uses an internal certificate authority, the SchemAlign execution environment or connector runtime must be configured to trust the required certificate chain where supported.

Capacity considerations

SchemaDock can carry multiple independent TCP streams. Actual throughput depends on:

  • customer network bandwidth
  • latency between the SchemaDock host and SchemAlign
  • latency between SchemaDock and the private destination
  • destination server performance
  • characteristics of the application protocol

Bulk transfers and chatty request/response protocols can react differently to the same network path.

Do not introduce protocol-specific SchemaDock tuning unless a generic transport defect has been demonstrated.

Connectivity checklist

Before enrollment or production use, confirm:

  • [ ] the SchemaDock host can reach the SchemAlign gateway over TCP 443
  • [ ] outbound TLS inspection or firewall policy does not block the gateway connection
  • [ ] the SchemaDock host can resolve required private hostnames
  • [ ] the SchemaDock host can connect to each required private destination port
  • [ ] destination policy is configured for the intended hosts and ports
  • [ ] the Dock is authorized for the organization that owns the pipeline