Study guide
2.3 Network Zones, Multi-DC Routing & Firewall Traversal
Dynatrace Certified Associate Exam
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Platform Overview, Deployment Models & Architecture
1.1 Dynatrace Platform Capabilities, Web UI Navigation & the Dynatrace Hub 1.2 SaaS vs. Dynatrace Managed Architecture & Security 1.3 Core Telemetry Components: OneAgent, ActiveGate & Grail Lakehouse 1.4 Licensing Models: Dynatrace Platform Subscription (DPS) & Davis Data Units (DDUs)
2 Chapter 2: ActiveGate Architecture & Network Topologies
2.1 ActiveGate Types: Environment vs. Cluster ActiveGates 2.2 ActiveGate Capabilities: Proxying, Private Synthetic, Cloud Integrations & Extensions 2.3 Network Zones, Multi-DC Routing & Firewall Traversal
3 Chapter 3: OneAgent Deployment, Configuration & Management
3.1 OneAgent Architecture, Components & Automatic Injection 3.2 Host Installation on Linux, Windows & Containerized Hosts 3.3 Cloud-Native Deployment: Dynatrace Operator on Kubernetes & OpenShift 3.4 Kubernetes Observability: Clusters, Nodes, Namespaces, Workloads & Events
4 Chapter 4: Monitoring Modes, Process Groups & Infrastructure Observability
4.1 Monitoring Modes: Full-Stack vs. Infrastructure-Only vs. Discovery 4.2 Process Groups, Process Instances & Custom Process Group Detection Rules 4.3 Host Groups, Host Naming Rules & Environmental Metadata Extraction 4.4 Infrastructure & Operations: Host Health, Disk, Network & Availability Analysis 4.5 Database Observability: The Databases App, Connection Pools & Storage Latency
5 Chapter 5: Smartscape Topology & Service Flow
5.1 The 5-Layer Smartscape Topology: Datacenter to Application 5.2 Service Detection: Web Services, Background Tasks & Custom Services 5.3 Service Flow, Backtrace Analysis & Horizontal/Vertical Dependency Mapping
6 Chapter 6: PurePath Distributed Tracing & Code-Level Diagnostics
6.1 PurePath Architecture, Distributed Tracing & Request Context Propagation 6.2 Method Hotspots, CPU Profiling & Memory Allocation Thread Analysis 6.3 Database Service Diagnostics, Slow Queries & Exception Analysis
7 Chapter 7: Davis AI Engine, Baselining & Causation
7.1 Davis Deterministic Causation Engine vs. Pure Correlation 7.2 Automated Dynamic Baselining, Percentiles & Traffic Seasonality 7.3 Event Ingestion, Event Types & Event Hierarchy in Problem Evolution
8 Chapter 8: Problem Lifecycle, Root Cause Analysis & Alerting
8.1 Problem Lifecycle, Severity Categories & Root Cause Cards 8.2 Alerting Profiles, Delay Filters & Management Zone Routing 8.3 Problem Notification Integrations: Webhooks, Slack, ServiceNow & ITSM
9 Chapter 9: Digital Experience Monitoring: Synthetic Monitoring
9.1 Synthetic Monitors: HTTP, Single-Step Browser & Multi-Step Clickpaths 9.2 Private Synthetic Locations, ActiveGate Engines & Credential Vault 9.3 Outage Detection, Performance Baselining & Maintenance Suppression
10 Chapter 10: Digital Experience Monitoring: Real User Monitoring (RUM)
10.1 RUM Architecture, OneAgent Script Injection & Mobile/OpenKit Telemetry 10.2 User Actions: Load vs. XHR/Fetch Actions, Visually Complete & Speed Index 10.3 Apdex Performance Ratings, User Sessions & Session Replay Masking
11 Chapter 11: Log Management and Analytics on Grail with DQL
11.1 Log Management on Grail: Storage, Ingestion Pipelines & Log Masking 11.2 Dynatrace Query Language (DQL): Fetch, Filter, Fields & String Operations 11.3 DQL Aggregations: Summarize, MakeTimeseries, Sorting & Visualizations
12 Chapter 12: Platform Governance, OpenTelemetry & Automation
12.1 Management Zones: Scoping Observability, Dashboards & Access Control 12.2 Tagging Strategies: Automated Rule-Based Tags, Manual Tags & AWS/K8s Metadata 12.3 OpenTelemetry Ingestion, OpenPipeline & Dynatrace Workflows Automation
13 Chapter 13: Cloud Integrations & Agentless Infrastructure Ingestion
13.1 AWS, Azure & Google Cloud Integrations 13.2 VMware vSphere, Extensions & Other Agentless Ingestion Paths
14 Chapter 14: Business Analytics & Business Events
14.1 Business Events: Capture, Ingestion & the bizevents Grail Table 14.2 Business Analytics: Connecting Performance to Revenue, Conversion & KPIs
15 Chapter 15: Notebooks, Dashboards & Data Visualization
15.1 Notebooks: Section-Based Investigation & Shareable Analysis 15.2 Dashboards: Tiles, Variables, Segments & Continuous Monitoring 15.3 Choosing Visualizations: Data Explorer, Chart Types & Metric Selection
16 Chapter 16: Reporting, Metrics & User Behavior Analysis
16.1 Metrics on Grail: Built-in Metrics, Granularity & Retention 16.2 Dashboard Reports, Subscriptions & Exporting Data via APIs 16.3 User Behavior Analysis: Bounce Rate, Landing & Exit Pages, Conversion Goals 16.4 Session Segmentation, User Journeys & Funnel Drop-Off Analysis
17 Chapter 17: Security, Vulnerability Analytics & Application Protection
17.1 Platform Security: Data Privacy, Encryption & Access Control 17.2 Third-Party Vulnerabilities, the Davis Security Score & Security Advisor 17.3 Code-Level Vulnerabilities, Attacks & Runtime Application Protection 17.4 Security Investigator, Notifications & the Remediation Workflow
2.3 Network Zones, Multi-DC Routing & Firewall Traversal
Key Takeaways Explain This Topic AI
Network Zones establish logical boundaries that prioritize local ActiveGate routing, drastically reducing cross-region WAN bandwidth and inter-datacenter latency.
OneAgent routing logic follows an automatic hierarchy: prioritizing ActiveGates within its own Network Zone before evaluating configured fallback zones or direct cluster endpoints.
Strict unidirectional communication guarantees that OneAgents always initiate outbound connections to ActiveGates (port 9999), preventing firewalls from needing inbound pinholes into production subnets.
Multi-tier ActiveGate chaining enables deep DMZ traversal, allowing isolated backend enclaves to route telemetry through internal and perimeter ActiveGates to Dynatrace SaaS without exposing internal IP space.
Last updated: September 2026
2.3 Network Zones, Multi-DC Routing & Firewall Traversal
Enterprise computing infrastructures are rarely homogeneous or flat. Organizations routinely operate hybrid cloud networks comprising multiple public cloud regions (e.g., AWS us-east-1, Azure West Europe), geographically distributed on-premise datacenters, and secure computing enclaves such as PCI-DSS payment zones or HIPAA data repositories.
Without intelligent routing governance, monitoring agents in an AWS VPC could randomly connect to an on-premise ActiveGate over an expensive DirectConnect circuit, incurring significant egress costs and high network latency. Dynatrace Network Zones and ActiveGate Chaining provide the architectural controls necessary to manage multi-datacenter routing, enforce traffic locality, and securely traverse complex enterprise firewalls.
Network Zones: Architecture and Purpose
A Network Zone is a user-defined, case-sensitive string identifier (such as aws-us-east-1 , datacenter-frankfurt , or pci-enclave ) assigned to OneAgents and ActiveGates. Network Zones enforce the following operational principles:
Data Locality: Ensuring that telemetry generated by OneAgents in a specific datacenter or cloud region stays within that physical or logical boundary by routing exclusively through local ActiveGates.
WAN & Cloud Egress Cost Reduction: Eliminating cross-region or cloud-to-on-premise data egress fees by preventing agents from communicating across expensive network links when local gateways exist.
Latency Optimization: Reducing round-trip connection overhead for high-frequency distributed tracing and metric streaming by ensuring OneAgents connect to geographically adjacent gateways.
Compliance & Isolation: Enforcing that monitored systems inside regulated subnets route their data strictly through designated gateways that meet specific auditing or encryption standards.
OneAgent Endpoint Selection & Routing Algorithm
When a OneAgent initializes or establishes a new connection, it determines which ActiveGate to connect to by executing a deterministic, prioritized routing algorithm: [Step 1: Check Assigned Network Zone]
Are any healthy ActiveGates available in the OneAgent's assigned Network Zone?
│
├─► YES: Randomly connect to a healthy ActiveGate in this zone (load balanced).
- ▼ NO
- [Step 2: Check Configured Fallback Zones]
Is a fallback zone configured (e.g., fallback = "dc-backup")?
│
├─► YES: Connect to a healthy ActiveGate in the fallback zone.
- ▼ NO
- [Step 3: Check Default Zone / Direct Cluster Access]
Is fallback to the default (empty) network zone permitted?
- │
- ├─► YES: Connect to an ActiveGate without an assigned zone, or connect
│ directly to the Dynatrace Cluster if network routing allows.
- ▼ NO
- [Step 4: Local Buffering / Spooling]
Buffer telemetry locally in host memory and disk; retry Step 1 periodically.
The Priority Hierarchy in Detail
Priority 1 — ActiveGates in the Same Network Zone: The OneAgent queries its cluster-provided endpoint list and filters for ActiveGates sharing its exact, assigned Network Zone name. If multiple ActiveGates exist in the zone, OneAgent balances its traffic across them.
Priority 2 — ActiveGates in Fallback Network Zones: If all ActiveGates in the primary zone become unreachable (due to host crashes, maintenance, or network partition), OneAgent looks for ActiveGates in configured fallback zones (defined as a comma-separated priority list).
Priority 3 — Default Zone ActiveGates & Direct Cluster Connection: If no fallback zone is defined and general fallback is permitted, OneAgent attempts to connect to ActiveGates that have no network zone assigned (the default zone) or attempts direct communication with the Dynatrace Cluster (SaaS or Managed) over port 443.
Strict Isolation (Fallback Disabled): In highly secure environments, administrators can disable network zone fallback entirely. When fallback is disabled and all local ActiveGates become unavailable, OneAgent refuses to route data across alternative networks. It spools metrics and traces locally in host memory and disk cache, continuously retrying the local ActiveGates until they recover.
Automatic Recovery and Reversion
OneAgent failover is fully dynamic. Even when a OneAgent is actively connected to a fallback zone ActiveGate, it continues to probe the status of its primary local Network Zone endpoints in the background. As soon as a local ActiveGate recovers, OneAgent seamlessly switches its active connection back to the primary zone, preserving optimal network performance without administrator intervention.
Configuring Network Zones Across the Enterprise
Network Zones must be declared on both the ActiveGates and the monitored OneAgent hosts.
- Configuring the Network Zone on an ActiveGate
- On the ActiveGate host, edit custom.properties : [network_zone]
- networkZone = aws-us-east-1
Restart the ActiveGate service ( systemctl restart dynatracegateway ) to register the zone with the Dynatrace cluster.
Configuring the Network Zone on OneAgent
OneAgents can be assigned a Network Zone using three distinct methods:
- At Installation Time (Installer Flag): # Linux
- /bin/sh Dynatrace-OneAgent-Linux.sh --set-network-zone=aws-us-east-1
- # Windows
- Dynatrace-OneAgent-Windows.exe --set-network-zone=aws-us-east-1
- Post-Installation via oneagentctl CLI: # Set the network zone
- ./oneagentctl --set-network-zone=aws-us-east-1
- # Verify the active network zone
- ./oneagentctl --get-network-zone
- # Inspect current active endpoints received from cluster
- ./oneagentctl --get-activegate-endpoints
Centrally via the Dynatrace Web UI: Under Settings > Preferences > Network Zones , administrators can define global fallback rules and create automated assignment rules based on host metadata, host groups, or IP subnets.
Multi-Tier ActiveGate Chaining & DMZ Firewall Traversal
In banking, healthcare, government, and PCI-DSS compliant environments, backend servers (e.g., core database servers or payment transaction engines) are placed in deeply isolated enclaves with zero direct internet or perimeter access. Outbound connections are strictly limited to adjacent internal network segments.
Dynatrace solves this with Chained (Multi-Tier) ActiveGates , where one ActiveGate proxies through another ActiveGate before reaching Dynatrace.
- Chained ActiveGate Communication Flow [Internal Database Enclave]
- └─► OneAgent on Database Host
- │
- │ TCP 9999 (Local Subnet HTTPS)
- ▼
- [Tier 1: Internal Environment ActiveGate]
- │
- │ TCP 9999 (Internal Firewall Traversal)
- ▼
- [DMZ / Perimeter Network]
- [Tier 2: Perimeter ActiveGate / CAG]
- │
- │ TCP 443 (Outbound Internet / Egress Proxy)
- ▼
- [Dynatrace SaaS Core (*.live.dynatrace.com)]
- Why This Satisfies Strict Firewall Policies
Zero Inbound Openings: The database enclave firewall only allows outbound TCP port 9999 traffic to the internal ActiveGate IP. No traffic can ever enter the database enclave from the DMZ.
No Direct Internet Routing: The internal ActiveGate cannot reach the internet; it only routes outbound TCP port 9999 traffic to the perimeter ActiveGate in the DMZ.
IP Hiding & Consolidation: Upstream firewalls only need to permit outbound port 443 traffic from the perimeter ActiveGate IP to Dynatrace SaaS, completely hiding all internal database host IP addresses.
Corporate Forward Proxies & Authentication
In organizations where all outbound internet traffic must pass through an enterprise forward proxy (such as Squid, BlueCoat, Zscaler, or Cisco Web Security Appliance), ActiveGates can be configured to egress through the proxy.
ActiveGates support HTTP forward proxying with Anonymous, Basic, or NTLM authentication . The proxy parameters are defined in custom.properties : [http.client.proxy]
- host = corporate-proxy.internal.corp
- port = 8080
- user = dynatrace-egress-svc
- password = EncryptedOrPlainPassword
- exceptions = *.internal.corp;10.*.*.*
The exceptions directive specifies internal IP ranges and hostnames that the ActiveGate must connect to directly without routing through the forward proxy (such as local OneAgents, child ActiveGates, or internal vCenter servers).
- Enterprise Routing & Firewall Matrices
- Network Zone Failover Decision Matrix
Primary Zone Status Fallback Zone Configured? Fallback Allowed? OneAgent Connection Result
Healthy (At least 1 AG up) Any Any Connects to healthy ActiveGate in primary assigned zone.
All Zone AGs Down Yes (e.g., dc-backup ) Yes Connects to ActiveGate in designated fallback zone ( dc-backup ).
All Zone AGs Down No fallback zone set Yes (Default fallback) Connects to default (unassigned) ActiveGate or direct to cluster.
All Zone AGs Down Any No (Fallback disabled) Refuses cross-zone egress. Spools telemetry locally on host until local AG recovers.
Firewall Port Traversal Matrix Across Tiers
- Source Component Destination Component Destination Port Protocol Purpose
- OneAgent Local ActiveGate TCP 9999 HTTPS Real-time metric, trace, log, and topology transport
Internal ActiveGate (Tier 1) Perimeter ActiveGate (Tier 2) TCP 9999 HTTPS Chained ActiveGate proxy forwarding across DMZ
- Perimeter ActiveGate Dynatrace SaaS / Managed TCP 443 HTTPS Aggregated telemetry egress to Dynatrace platform
- ActiveGate VMware vCenter API TCP 443 HTTPS Agentless hypervisor metrics and inventory polling
- ActiveGate Network Devices / Switches UDP 161 SNMP Extensions 2.0 network device polling
- ActiveGate Monitored Targets Various JDBC / TCP Extensions 2.0 database querying (e.g., port 1433, 1521, 5432)