Pega Cloud Services networking details
Pega Cloud Services maintains a robust set of networking and security controls that enables you to take advantage of the power of Pega Platform, strategic applications, and third-party integrations delivered as a cloud-delivered service.
Connecting to Pega Cloud
You have access to applications and integration services deployed in your Pega Cloud Services virtual space through a secure internet connection. Pega Cloud Services supports the following connectivity methods:
This option supports secure internet access for all user traffic, such as hosted applications and Dev Studio, as well as integration services traffic.
For private network connectivity, several private access services for connection traffic are available.Internet plus private connection
This option includes secure internet access for all user traffic, as described above, as well as the option to have private access services to your private network for all inbound and outbound traffic.
Accessing your Pega Cloud Services virtual space
Each client environment within your Pega Cloud Services virtual space supports a series of Pegasystems application computing resources. You can connect to each application with a public IP address and a private IP address. During the client onboarding delivery process, Pega Cloud disables inbound traffic (client to Pega Cloud environment) by default and only enables inbound traffic based on your application needs. Pegasystems allows all outbound traffic (Pega Cloud environment to client) for each instance by default.
In your Pega Cloud environment, your connections originate from a pool using three static source IP addresses to connect to your enterprise network. This highly available connection system offers a secure, flexible, and scalable way to integrate with your enterprise network. All environments in your Pega Cloud environment share from this pool of static source IP addresses.
For the best experience with your Pega Cloud Services virtual space, use an entirely public connection topology with encryption. Connections that rely on an entirely public connection topology offer the most flexibility for the following use cases:
- Integrations (such as adding additional third-party services)
- Enterprise network variations (such as scaling your enterprise network)
Other changes made from the client end after your Pega Cloud environments are integrated into your network.
For more information about adding public connections to an allow list and configuring private access to and from your Pega Cloud environment, see Configuring public access between your Pega Cloud environment and Configuring private access to your Pega Cloud environment.
Pega Cloud Services does not resolve network connectivity to your Pega Cloud environments using IP addresses. Instead, Pega Cloud relies on the DNS (Domain Name System) server for the enterprise network of each client for communication between your Pega Cloud environments and the public internet. During onboarding, Pega requires you to share your DNS name resolution protocol so that Pega Cloud Services can configure your environment connectivity to use your DNS server. As long as the DNS server in your enterprise environment provides name resolution, network traffic can access your Pega applications.
Pega Cloud Services assigns each client a single public domain for public internet access for your Pega Cloud Services virtual space. In addition, Pega Cloud Services maintains a private host zone for internal communications.Pega Cloud Services uses the following naming convention for the public domain:
If you only want remote access to your private servers or private services through your Pega Cloud Services environment, Pega can add custom DNS entries to the private host zone. Pega Cloud Services uses the following naming convention for the private host zone:
Pega Cloud Services provides the option for clients to use a customized domain, for example:
For details about creating a custom domain, see Requesting a custom domain name for applications hosted in Pega Cloud.
Pega also supports the ability to forward traffic to domains, IP addresses, or host zones that you have specified in your DNS server resolver rules.
- For inbound connections, Pega Cloud Services can resolve domains to a private host zone on your Pega Cloud environment.
- For outbound connections, Pega Cloud Services can specify domains and IP
addresses that you want to forward to match a specific resolver rule. For
example, if you connect to a domain that contains multiple resolver rules
mortgage.com), Pega can forward the query to the domain with the most specific match (
Transit Gateway integration
Pegasystems supports the integration of the AWS Transit Gateway to your Pega Cloud environments. The Transit Gateway acts as a cloud hub external to the client VPC that connects other VPCs and on-premises systems to you Pega Cloud environments. The Transit Gateway eliminates the need for complex peering relationships for communication between your Pega Cloud environments and other cloud environments within your topology while inherently remaining on a private connection through the AWS VPN.
For more information about the AWS Transit Gateway, see AWS Transit Gateway landing page.
For detail about how to integrate your AWS Transit Gateway with your Pega Cloud environments, see Integrating the Transit Gateway.
To ensure secure private integration, HTTPS is recommended for REST and SOAP services. The SSL certificate for each private domain must match the certificate on the client-managed server.
- Requesting a custom domain name for applications hosted in Pega Cloud
For your applications that are hosted in your Pega Cloud Services virtual space, a client can use a custom domain name that conforms to your enterprise standards.
- Configuring public access between your Pega Cloud environment and your enterprise network
Pega Cloud Services offers a range of connectivity options to manage traffic between your Pega Cloud Services environment and your enterprise network while fulfilling your network topology security requirements. Pega Cloud Services supports clients who choose to employ allow lists as a practice in their security model.
- Configuring private access to your Pega Cloud environment
Pega Cloud Services supports several connectivity options to manage private network traffic between your Pega Cloud Services environment and your enterprise network while fulfilling your network security requirements. These private access protocols, which include hybrid topologies that use multiple secure connection types for redundant and high-availability configurations, deliver secure connectivity between your Pega Cloud Services environments and external endpoints on your enterprise network.