# PAM360 Application Gateway

The PAM360 Application Gateway acts as a secure intermediary between PAM360 and managed resources, enabling PAM360 to perform privileged resource management operations on managed systems without directly exposing internal systems to the internet. By deploying the Application Gateway within the customer environment, organizations can perform operations such as resource discovery, account discovery, credential verification, password reset, secure remote access, and scheduled resource management tasks. All communication between PAM360 and the Application Gateway is secure and encrypted.

At the end of this document, you will have learned the following topics in detail:

1. [How the Application Gateway Works](https://www.manageengine.com/privileged-access-management/help/cloud/ag-overview.html#How_the_Application_Gateway_Works)
2. [Communication Between Application Gateway and PAM360](https://www.manageengine.com/privileged-access-management/help/cloud/ag-overview.html#Application_Gateway_and%20PAM360_Communication)
3. [Limitations](https://www.manageengine.com/privileged-access-management/help/cloud/ag-overview.html#Limitations)

## 1. How the Application Gateway Works

i. **Deployment**: The Application Gateway is deployed on a Windows or Linux machine within the customer environment that has access to the target resources.

ii. **Secure Connection Establishment**: The Application Gateway establishes communication with PAM360 to enable privileged management operations on managed resources.

iii. **Resource and Account Discovery**: The Application Gateway can discover privileged resources and associated accounts accessible within the environment. Discovered resources are added to the PAM360 inventory.

iv. **Resource Association**: Administrators can associate discovered or existing resources with a specific Application Gateway for further management operations.

v. **Task Execution**: When an operation such as password verification or password reset is initiated from PAM360, the request is routed through the associated Application Gateway, which executes the task on the target resource.

vi. **Status and Audit Updates**: Execution status and operation results are securely transmitted back to PAM360 for monitoring, tracking, and auditing purposes.

## 2. Communication Between Application Gateway and PAM360

The Application Gateway maintains a secure outbound connection with PAM360 to enable continuous communication and real-time status monitoring. On the Application Gateway page, the gateway status is displayed as either **Active** or **Inactive**, allowing administrators to verify its availability and operational state.

When an operation such as password verification or password reset is initiated for a resource associated with an Application Gateway, PAM360 securely routes the task to the gateway. The Application Gateway executes the task on the target resource and sends the execution status back to PAM360 for monitoring, tracking, and auditing purposes. All communication between PAM360 and the Application Gateway is encrypted to ensure secure handling of credentials and privileged operations.

If the Application Gateway is unavailable during task execution, the task is temporarily queued in PAM360. If the gateway remains unreachable beyond the retry period, the task is marked as expired and its status is updated in the **Application Gateway Task Monitor** and audit records.

## 3. Limitations

- Application Gateway mapping will not be retained when a resource is duplicated.
- IPv6 addresses are not supported during Application Gateway configurations.