--- name: satellite-connector-faq title: Satellite Connector FAQ description: Find answers to common questions about Satellite Connector, including endpoint support and agent configuration. last-updated: 2026-08-27 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/satellite?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Satellite Connector FAQ {: #connector-faq} Find answers to common questions about Satellite Connector, including endpoint support and agent configuration. {: shortdesc} ## Does Satellite Connector support Cloud Endpoints? {: #connector-faq-endpoints} Yes, Satellite Connector supports both Location and Cloud endpoints. For more information, see [Creating Connector endpoints in the CLI](https://cloud.ibm.com/docs/satellite?topic=satellite-connector-create-endpoints&interface=cli&format=markdown). ## How can I restrict access to my location endpoints? {: #connector-faq-restrict} You can set up access control list (ACL) rules to restrict access to your endpoints. When you create your link endpoint, select an existing ACL rule or create a new ACL rule to control which clients can access location endpoint resources. If no ACL rule is selected, any client that is connected to the IBM Cloud private network can use the endpoint to connect to the destination resource that runs in your location. ## How can I restrict the Connector Agent access on my network? {: #connector-faq-agent-restrict} Use any standard firewall in your location to restrict the endpoints on your network that are accessible to the Connector Agent. On Windows, for example, you can configure Windows firewall to allow the agent to only access the specific set of endpoints needed by your application. However, when using a firewall, make sure the firewall also allows access to the required endpoints described in [network requirements](https://cloud.ibm.com/docs/satellite?topic=satellite-understand-connectors&format=markdown#network-requirements). ## I created an ACL for my Connector, why doesn't it take effect? {: #connector-faq-acl-implementation} Make sure you apply the ACL to the endpoint you want to use it against. ## What Identity and Access Management (IAM) permissions do I need for Connectors? {: #conector-faq-permissions} To create a Connector, you need **Administrator** Platform role for Satellite. To connect an Agent to an existing Connector, you need **Viewer** Platform role for Satellite. ## How many Connectors are supported per account per region? {: #connector-faq-con-per-region} IBM Cloud Satellite supports a maximum of 25 Connectors per account per region. ## How many endpoints are supported per Connector? {: #connector-faq-endpoints-per-conn} `cloud` endpoints : According to IBM Satellite service limits, each Connector supports up to 1,000 cloud endpoints. IBM Satellite Connector allows up to 650 of these as Transport Layer Security (TLS) endpoints and up to 350 as Hypertext Transfer Protocol (HTTP) endpoints, through which clients in your location can connect to resources outside of the location network. `location` endpoints : According to IBM Satellite service limits, each Connector supports up to 25 location endpoints. IBM Satellite Connector allows up to 20 of these as TLS endpoints and up to 5 as HTTP endpoints, through which clients outside of your location network can connect to resources inside the location. ## How many instances of Connector agent can I run? {: #connector-faq-instance-limits} Satellite Connector allows a maximum of 6 agents per Connector. For high-availability deployments, IBM recommends deploying at least 6 agents across separate hosts. For more information, see [Minimum requirements for running the agent image](https://cloud.ibm.com/docs/satellite?topic=satellite-understand-connectors&format=markdown#min-requirements). ## Can I deploy Satellite Connectors within IBM Cloud? {: #connector-ibm-cloud} Connectors are generally not recommended for use within IBM Cloud except for specific use cases. Contact your IBM account team if you believe you need this support for your solution. ## What version of TLS does Connector use? {: #conector-faq-tls} Connector uses TLS version 1.3. ## How does load balancing work across Satellite Connector? {: #conector-faq-lbs} Satellite Connector distributes Transmission Control Protocol (TCP) streams in round robin across all connected agents. Multiple TCP streams are required to take full advantage of the agents. ## What are the failover or disaster recovery expectations of agents and Connector? {: #conector-faq-dr} IBM manages the cloud side of the Satellite Connector service, which is distributed across IBM Cloud multizone regions (MZRs), so agents automatically have redundancy across different resources in each zone. According to IBM Connector architecture guidance, deploy at least 3 agents per availability zone — for example, 3 VMware hosts if you're on VMware — to align with your cloud provider's availability zones. ## How do I measure and monitor connections that are using Satellite Connector? {: #conector-faq-connections} There are many options to monitor Satellite Connector and the things that use Satellite Connector. Specifically, you can use [IBM Cloud Monitoring](https://cloud.ibm.com/docs/monitoring?format=markdown) and [Cloud Logs](https://cloud.ibm.com/docs/cloud-logs?format=markdown) which can provide many metrics. The logs always have "flowlog" entries which are meant to track traffic using Satellite Connector. Agents are either containers or running on a Windows host and both of these platforms offer methods of observing traffic flowing through the Satellite Connector service. ## What happens when an agent goes down? {: #conector-faq-recover} The tunnel and agent have recurring heartbeat message. When an agent goes down, the tunnel will drop the connection to the agent and stop routing traffic through that agent. Existing live TCP streams will be interrupted but retries and reconnects use the other agents.