Service Connector

Service Connector is a private IPSec connection between your network and the Netgraph cloud, so several Services reach your on-premises systems over one tunnel instead of the public internet.

Service Connector is a private IPSec connection between your own network and the Netgraph cloud. Instead of a Service communicating over the public internet, a firewall (or any on-premises device that supports IPSec) on your side establishes a tunnel to the platform, and the traffic for the Services you bind to it travels over that private path. One tunnel can carry several Services at once.

It is the option to reach for when you want to keep authentication and management traffic off the public internet, or when your security policy requires a private connection to cloud Services.

What it carries today

Service	What travels over Service Connector
EntryPoint	RADIUS authentication and accounting, and RadSec, between your network equipment and the platform. See Service Connector for EntryPoint.
Endpoint Manager for Cisco ISE	The platform’s access to your on-premises Cisco ISE management interface. See Service Connector for Endpoint Manager.
Webhooks	Webhook deliveries POSTed from the platform to an endpoint on your own network, through the tunnel instead of over the public internet. See Webhooks.
EasyPSK via RADIUS	The RADIUS path between your wireless network and an EasyPSK EntryPoint Context. See EasyPSK via RADIUS.

Sign In is not carried over Service Connector. Sign In uses the separate Service Gateway — a Cisco router that delivers DHCP, DNS, routing, and its own secure tunnel.

How it works

One IPSec tunnel is established from an IPSec endpoint on your side to a dedicated endpoint on the platform, authenticated with a pre-shared key. Once the tunnel is up, the platform binds the Services you choose to it, so their protocols are reachable privately: for EntryPoint this is the RADIUS path; for Endpoint Manager it is the connection the platform uses to reach Cisco ISE; for webhooks it is the delivery POSTs to your endpoint. You can run one or more Services over a single Service Connector tunnel.

Network equipment · RADIUS

Cisco ISE

Webhook receiver

→

Your firewall IPsec endpoint

IPSEC⇄one tunnel · pre-shared key

Netgraph cloud EntryPoint · Endpoint Manager · Webhooks

One tunnel carries every Service you bind to it: EntryPoint's RADIUS path runs inbound to the platform, while Endpoint Manager's Cisco ISE access and webhook deliveries run outbound to your network.

Service Connector list showing a connector, its tunnel status, and the Services bound to it — A Service Connector with its IPSec tunnel up and one or more Services bound to it.

Setting one up

The work splits between your network team and the platform:

Stand up the IPSec endpoint on your side

Configure an IPSec tunnel from a firewall or IPSec-capable device to the platform endpoint, authenticated with the pre-shared key agreed for the connector. This is standard IPSec on equipment you already run; the platform side is the fixed peer.
Register the Service Connector on the platform

The connector is represented on the platform with the tunnel’s endpoints and key, so the platform knows which private path to use.
Bind the Services

Bind each Service that should run privately — your EntryPoint Contexts, your Endpoint Manager Context, your webhooks — to the connector. From then on, that Service’s traffic uses the tunnel instead of the public internet. The per-Service pages below cover what that looks like for each.

Service Connector detail page showing the IPSec tunnel and a bound EntryPoint Service — A Service Connector's detail with a bound Service and the private path it uses.

What you need

Item	Requirement
Customer-side endpoint	A firewall or device that supports IPSec
Authentication	A pre-shared key for the tunnel
Bound-Service connectivity	The protocols of the connected Service (for example RADIUS for EntryPoint, or access to Cisco ISE for Endpoint Manager)

The alternative, where a private tunnel is not required, is direct connectivity over the public internet (RADIUS, with RadSec where the transport must be secured; HTTPS for Cisco ISE).