Air-gapped

Install, license, update and support XPLG where no internet path exists: media transfer of installers and images, the server-key license exchange, patch zips, the internal realm, the integrations that stay off, and what dock can see.

What you will do: run a deployment that never talks to the internet and still get it licensed, updated and supported.

Air-gapped deployment is fully supported. XPLG is self-hosted and non-SaaS, is never operated from vendor sites, needs no inbound internet exposure and has no call-home channel carrying content; nothing leaves your segments unless you configure a forwarding destination. In the wiki's words, XPLG "does not require internet access to function properly" — only a few integrations do, and they are listed below.

Steps

Bring the software in on media. V7: download the installer from the Download Center on www.xplg.com on a connected machine and carry it in. X8: on a connected host docker pull the image, docker save it, docker load it on the air-gapped host — or mirror the tag into your own registry and point XPLG_IMAGE at it — and carry the xplg-service bundle in the same way. See Docker and Virtual machine and bare metal.
Install and configure as usual. Clusters need synchronised clocks, so point NTP at an internal time source. Storage, ports and certificates are the same as on any site: Networking and ports, TLS certificates.
License by file. Under PortX > Settings > License generate the server key (one for a whole cluster, from any node), send it to XPLG from any mailbox, receive the .lic file, carry it in and upload or paste it on the same page; restart afterwards. The SDK applies it remotely from a host inside the enclave: -api license -files license.lic. Whether the product also reads a dock license key is pending on the product side — see How licensing works.
Sign-in without an external identity provider. The internal realm — local users with managed passwords — is the documented option for isolated environments; Active Directory and LDAP, Kerberos, SiteMinder and WebSeal, and header-based SSO work when the directory or gateway lives inside the enclave. See Users and SAML, OAuth and SSO gateways.
Update from a zip or an image tag. V7 patches are zip files published from PortX > System > About > Publish Patch to every node, or with the CLI update package (applyPatch.sh / applyPatch.bat; it needs Java and HTTP/S access from the host that runs it to every instance, not the internet). X8 upgrades are a new image tag brought in as in step 1, then XPLG_IMAGE, pull, up -d. The About page's link to the latest version on the XPLG website does not work offline; read what each build needs in Release notes and follow Upgrades.
Know which integrations stay off. Microsoft Teams, Slack, PagerDuty, Office 365 and Azure AD collection, S3 and other cloud APIs need an outbound route; a proxy set in the lax file (-Dhttps.proxyHost, -Dhttps.proxyPort, -DproxySet=true) is the supported way to allow some of them. E-mail, SNMP, script, REST calls to internal targets, syslog, JMS and Kafka alerts keep working.
Support by export. Export the System Report (About > Export System Report, an XML file) and the Support Portal's system logs and activity information, and send them from a connected machine. Support access to a customer environment, when you grant it at all, is VPN-only and MFA-enforced; none is required to run the product.

What dock can see

dock registers a deployment on its first heartbeat to dock.xplg.com over HTTPS and shows usage from the later ones. A deployment with no path to dock — not even through a proxy or an egress rule — is never listed and shows no meters; there is no offline registration or manual usage upload today. Licenses still reach you as .lic files, and your organization, offers, invoices and tickets are managed from any connected workstation. See Register a deployment.

Next: Agent Mode

Source: XPLG wiki, pages 3161980932, 3162013701, 3161718811, 3150774276, 3150544899, 1594133274, 1597014018, 1597964372, 1602191443, 1594133343, 1594132180, 1594133348, 1594132940, 1594131986, 3161849908, 1642397903 (https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/3161980932); dock deployments module.

Steps

Bring the software in on media. V7: download the installer from the Download Center on www.xplg.com on a connected machine and carry it in. X8: on a connected host docker pull the image, docker save it, docker load it on the air-gapped host — or mirror the tag into your own registry and point XPLG_IMAGE at it — and carry the xplg-service bundle in the same way. See Docker and Virtual machine and bare metal.

Install and configure as usual. Clusters need synchronised clocks, so point NTP at an internal time source. Storage, ports and certificates are the same as on any site: Networking and ports, TLS certificates.

License by file. Under PortX > Settings > License generate the server key (one for a whole cluster, from any node), send it to XPLG from any mailbox, receive the .lic file, carry it in and upload or paste it on the same page; restart afterwards. The SDK applies it remotely from a host inside the enclave: -api license -files license.lic. Whether the product also reads a dock license key is pending on the product side — see How licensing works.

Sign-in without an external identity provider. The internal realm — local users with managed passwords — is the documented option for isolated environments; Active Directory and LDAP, Kerberos, SiteMinder and WebSeal, and header-based SSO work when the directory or gateway lives inside the enclave. See Users and SAML, OAuth and SSO gateways.

Update from a zip or an image tag. V7 patches are zip files published from PortX > System > About > Publish Patch to every node, or with the CLI update package (applyPatch.sh / applyPatch.bat; it needs Java and HTTP/S access from the host that runs it to every instance, not the internet). X8 upgrades are a new image tag brought in as in step 1, then XPLG_IMAGE, pull, up -d. The About page's link to the latest version on the XPLG website does not work offline; read what each build needs in Release notes and follow Upgrades.

Know which integrations stay off. Microsoft Teams, Slack, PagerDuty, Office 365 and Azure AD collection, S3 and other cloud APIs need an outbound route; a proxy set in the lax file (-Dhttps.proxyHost, -Dhttps.proxyPort, -DproxySet=true) is the supported way to allow some of them. E-mail, SNMP, script, REST calls to internal targets, syslog, JMS and Kafka alerts keep working.

Support by export. Export the System Report (About > Export System Report, an XML file) and the Support Portal's system logs and activity information, and send them from a connected machine. Support access to a customer environment, when you grant it at all, is VPN-only and MFA-enforced; none is required to run the product.

What dock can see

Search documentation

Air-gapped

Install, license, update and support XPLG where no internet path exists: media transfer of installers and images, the server-key license exchange, patch zips, the internal realm, the integrations that stay off, and what dock can see.

Steps

What dock can see

Air-gapped

Install, license, update and support XPLG where no internet path exists: media transfer of installers and images, the server-key license exchange, patch zips, the internal realm, the integrations that stay off, and what dock can see.

Steps

What dock can see

Search documentation