Cryptzone Support

If you wish to submit a support ticket please sign in to your customer portal or use the “submit a ticket” button at the top menu.
If you need to find documentation about our Sheriff Suite please login to the Hive- Click Here



How-To OSX AppGate (classic) client integration with a 3rd party device firewall

« Go Back

Note: This article pertains to the AppGate IP Tunneling Driver (IPTD) running on Apple OS X Mavericks 10.9.2+ with a 3rd party device firewall.

Several AppGate daemons communicate with the AppGate client software using the internal loopback interface on the OS X client. (The default address is

When using a 3rd party device firewall that controls traffic on the internal loopback interface it is necessary to open specific TCP ports to allow the AppGate client to communicate with the daemons running on the local system.

Note: If the features provided by a specific daemon are not in used we still recommend allowing the traffic in the 3rd party device firewall. If traffic is NOT allowed the AppGate client will wait a predetermined timeout period when trying to communicate with each daemon before completing the login process. This will result in an extremely slow login process for your users.



ag_atend (tcp/48624-65535) - This process is used to run custom scripts when each session is completed.

ag_iptd (tcp/7270, tcp/48524-65535) - This process is used for tunneling UDP and dynamic port traffic.

ag_pfw (tcp/7271) - This process is the AppGate device firewall which should NOT be used if a 3rd party device firewall is in use.

ag_mud (tcp/7893) - This process is used when the AppGate client is installed on a multi-user system such as Citrix so the AppGate system can differentiate between individual users.



Configure the 3rd party device firewall ACLs to allow the following traffic flows. 

Permit loopback:tcp/7270 <-----> loopback:tcp/any

Permit loopback:tcp/any <-----> loopback:tcp/7270

Permit loopback:tcp/48524-65525 <-----> loopback:tcp/48524-65525

Permit loopback:tcp/7271 <-----> loopback:tcp/any

Permit loopback:tcp/any <-----> loopback:tcp/7271

Permit loopback:tcp/7893 <-----> loopback:tcp/any

Permit loopback:tcp/any <-----> loopback:tcp/7271







Article Info
3/13/2015 8:43 AM
1/10/2017 5:23 PM



Was this article helpful?



Please tell us how we can make this article more useful.

Characters Remaining: 255