Skip to main content

Gateway Moving and Decommissioning

Use this guide when moving a MyPass Gateway to a new server or retiring one. It is possible to move an existing Gateway. To avoid downtime, we recommend deploying and validating a new Gateway alongside the existing one, switching over, and then decommissioning the old Gateway. A Gateway may be used by multiple integrations, so confirm its dependencies and coordinate the change with your MyPass deployment partner before changing any infrastructure.

Moving a Gateway​

You can move an existing Gateway, but changing its server or public IP can interrupt connections while configuration is updated. For a zero-downtime move, use the parallel replacement process below: keep the existing Gateway running while you deploy and initialize a new Gateway, then switch over only after the new one has been validated.

  1. Confirm which integrations use the Gateway and plan a maintenance window with your MyPass deployment partner.
  2. Provision and configure the replacement server by following Gateway Deployment, including the required software, certificate, DNS, firewall access, and public NAT.
  3. If the Gateway's public IP address changes, configure the firewall and NAT for the replacement as described in the Publishing the Gateway section. Restrict inbound HTTPS (TCP 443) to the MyPass Cloud POD IP addresses listed in Network Requirements.
  4. Have the Gateway initialization run for the replacement. This updates the encrypted Gateway IP in the tenant and platform calling list. The new Gateway must be initialized before it can be used.
  5. Validate connectivity with your MyPass deployment partner and confirm that the integrations using the Gateway work as expected.
  6. Once the replacement is confirmed operational, follow the decommissioning steps below for the old Gateway.

If the public IP address stays the same, verify whether the existing DNS, firewall, NAT, and certificate configuration can be retained. Coordinate any required configuration changes and initialization with your MyPass deployment partner.

Decommissioning a Gateway​

Do not remove the old Gateway until you have confirmed it is no longer needed by any integrations and any replacement Gateway is working. Retiring a Gateway can interrupt services that depend on it.

  1. Confirm dependencies and timing. Identify all integrations using the Gateway, confirm they have been moved or retired, and agree on the change window with your MyPass deployment partner.
  2. Remove the Gateway from service. After confirming it is no longer in use, stop and remove the Gateway web services and decommission the Gateway server according to your organization's server-retirement process.
  3. Remove inbound firewall rules. Remove the edge-firewall rules created for this Gateway deployment that allow MyPass Cloud POD IP addresses to reach the Gateway over HTTPS (TCP 443). Preserve rules that are shared with other services or Gateways.
  4. Remove the public NAT. Remove the firewall or application-delivery-controller NAT mapping that forwards the Gateway's public IP and HTTPS traffic to the retired server. Do not remove a shared NAT mapping still used by another Gateway or service.
  5. Review related records and access. Remove or update DNS records that point to the retired Gateway, as applicable. Review Gateway-specific certificates, accounts, groups, and monitoring, and remove only items that are no longer shared or required.
  6. Confirm platform-side cleanup. Ask your MyPass deployment partner to remove the retired Gateway from the tenant and platform calling list, and confirm that no active integration still references it.

The original deployment's required inbound access and NAT are described in Gateway Deployment. Keep a record of the removed rules and mappings in your change documentation.