Service Connector

Service Connector is a private IPSec connection between the Netgraph cloud and the customer’s own network. Instead of a service communicating over the public internet, the customer’s firewall (or any on-premises device that supports IPSec) establishes a tunnel to the platform, and the relevant traffic for the connected services is carried over that private path.

At a glance

Purpose: Private IPSec connectivity between the platform and the customer network, instead of the public internet
Customer side: A firewall or any device that supports IPSec
Available for: EntryPoint Available · Endpoint Manager for Cisco ISE Available · Webhooks Available · EasyPSK via RADIUS Available
Not for: Sign In, which uses the separate Service Gateway
Alternative: Direct connectivity over the public internet, where a private tunnel is not required

What it is

Service Connector gives an organization a private route between its own network and the Netgraph cloud. A single IPSec tunnel is established from a customer-side IPSec endpoint to a dedicated endpoint on the platform. Once the tunnel is up, the traffic for the services bound to it travels through the tunnel rather than over the public internet. This is useful when an organization wants to keep authentication and management traffic off the public internet, or when its security policy requires a private connection to cloud services.

What it carries today

Service	What travels over Service Connector
EntryPoint	RADIUS authentication and accounting, and RadSec, between the network equipment and the platform
Endpoint Manager for Cisco ISE	The platform’s access to the on-premises Cisco ISE management interface
Webhooks	Webhook deliveries POSTed from the platform to an endpoint on the customer network, through the tunnel instead of over the public internet
EasyPSK via RADIUS	The RADIUS path between the customer’s Cisco wireless network and an EasyPSK EntryPoint context

Sign In is not carried over Service Connector. Sign In uses the Service Gateway instead (a Cisco router that provides DHCP, DNS, routing, and its own secure tunnel).

How it works

The customer configures an IPSec tunnel from a firewall or IPSec-capable device to the platform endpoint, authenticated with a pre-shared key. The platform binds the chosen services to that tunnel so their protocols are reachable privately: for EntryPoint this is the RADIUS path, for Endpoint Manager it is the connection the platform uses to reach Cisco ISE, and for webhooks it is the delivery of event POSTs to an endpoint on the customer network. The organization can run one or more services over a single Service Connector tunnel.

Network equipment · RADIUS

Cisco ISE

Webhook receiver

→

Customer firewall IPSec endpoint

IPSEC⇄one tunnel · pre-shared key

Netgraph cloud EntryPoint · Endpoint Manager · Webhooks

One tunnel carries every service bound to it: EntryPoint's RADIUS path runs inbound to the platform, while Endpoint Manager's Cisco ISE access and webhook deliveries run outbound to the customer network.

Customer requirements

Item	Requirement
Customer-side endpoint	A firewall or device that supports IPSec
Authentication	A pre-shared key for the tunnel
Bound-service connectivity	The protocols of the connected service (for example RADIUS for EntryPoint, or access to Cisco ISE for Endpoint Manager)