Documentation

Gateway Deployment

Step-by-step guide to deploying and enrolling a new Web Gateway

Gateway Deployment

Before you start

System Requirements

The table below outlines the minimum system requirements to deploy a gateway instance:

Item Requirement
CPU 2 vCPU
Memory 4GB
Disk 80GB of free space
Operating System Any Linux Distribution
Note: The values may vary depending on your architecture, expected throughput, and number of concurrent users. Please confirm them with your GAccess technical representative.

Network Requirements

The gateway will interact with your targets and users in many situations, so having a proper network access is mandatory for a successfull operation:

Direction Description Target
Outbound Communicate with GAccess Platform All 443
Outbound Communicate with Target Devices Target Network (22, 3389)
Inbound Receive connections to Proxy Enduser Connections It may vary according to your settings

Step 1 — Create the gateway record

  1. In the GAccess console, navigate to Web Gateways.
  2. Click Add Gateway.
  3. Fill in the required fields:
    • Gateway Name — a short identifier using only letters, numbers, and hyphens (e.g. prod-dc1). This cannot be changed after creation.
    • Description — optional, but recommended for teams managing multiple gateways.
    • Network Routes — add at least one route. Each route is a CIDR range (e.g. 10.10.0.0/24) and a friendly name (e.g. Production Servers). You can add more routes later. Use 0.0.0.0/0 if you want to use this gateway as default
  4. Click Create Gateway.

GAccess generates a One-Time Code (OTP) and displays it on screen. This code is shown only once, copy or download it before leaving the page.

Warning: The installation token expires after 5 hours. If it expires before you complete installation, go to the gateway's settings page and click Regenerate Token to issue a new one.

Step 2 — Download the installer

Click Download Installer on the confirmation screen, or download it directly to your server:

curl -LO https://gaccess-public-installers.s3.us-east-1.amazonaws.com/gaccess-gateway-installer-latest.tar.gz

Step 3 — Transfer to the target server

If you downloaded the installer on your local machine, transfer it to the server where the gateway will run.

Step 4 — Extract and run the installer

On the target server, extract the archive and run the installer, passing the platform URL and the one-time code:

tar -xzf gaccess-gateway-installer-latest.tar.gz
sudo ./gaccess-gateway-installer-*.sfx 'https://your-tenant.gaccess.cloud' '<your-otp>'

Replace https://your-tenant.gaccess.cloud with your platform URL and <your-otp> with the code you copied in Step 1.

The installer will:

  1. Check for system pre requirements.
  2. Install the required OS dependencies if missing.
  3. Install and configure the GAccess CLI manage_gaccess that will be used by admins to customize how the gateway operates.

Step 5 — Enroll and Deploy

After installing the basic components will should establish the trust relationship with GAccess platform (enroll) and complete the deployment:

sudo manage_gaccess deploy

This command will:

  1. Generate a cryptographic key pair on the server.
  2. Send a certificate signing request to the GAccess platform.
  3. Receive and store the signed certificate, which is signed by your GAccess tenant CA, valid for 45 days and used for mTLS.
  4. Register the server's public IP address with the platform.
  5. Start the all the gateway components.

What happens after enrollment

Once enrollment completes, the gateway appears as Online in the Gateways list within a few seconds. It will:

  • Send regular health updates to the platform, keeping its status current.
  • Accept session requests for any IP addresses covered by its configured network routes.
  • Automatically renew its certificate before it expires — no manual action needed.

The communication channel between the gateway and the platform uses mutual TLS: the platform only accepts the gateway's certificate (issued by your tenant's private certificate authority at enrollment time), and the gateway only trusts the platform's own CA. A compromised or revoked certificate cannot be used to impersonate a legitimate gateway.

Troubleshooting enrollment

Token expired before I could run the installer Go to Web Gateways, click the gateway's name, then click Open settings. Click Regenerate Token and repeat Steps 2–4 with the new code.

Gateway shows Offline immediately after installation Check that the server can reach the platform URL on port 443. Outbound HTTPS must not be blocked by a firewall or proxy. The gateway does not require any inbound ports.

Installer fails with a permission error Make sure you are running the installer with sudo. The installer needs elevated privileges to install the gateway service and write configuration files.