Skip to main content Skip to complementary content
Qlik Resources
Loading SearchUnify's search If you need assistance with your product, please contact Qlik Support.
Qlik Customer Portal
Loading SearchUnify's search If you need assistance with your product, please contact Qlik Support.
Qlik Customer Portal

Home > Data integration > Data gateways > Gateway host operations

Gateway host operations

Last updated: 2026-11-03

Cadence: Monthly

Subscription model: All (gateways are per-tenant for Direct Access; per-host for Data Movement gateway)

Roles: Tenant Admin (TA), Data Admin (DA—Data Movement gateway hosts)

Last verified: 2026-09

Initial Recurring
Estimated time 2 hr 30 min

Benefits:

  • Avoids silent connection failures from driver / DSN drift across multiple gateway hosts
  • Catches host-level issues (disk fill, clock skew, OS support drift) before they take a gateway offline
  • Documents the re-registration path for host rebuilds so DR isn't improvised
  • Keeps outbound network allowlist aligned with current Qlik Cloud and Talend Cloud endpoints

Goal

Daily gateway-health checks confirm the gateway is Connected from the tenant side. The host side has its own operational concerns that are easy to miss because the tenant UI doesn't surface them. The summary below covers each concern at a glance; the Gotchas section after the Tasks table has the detailed traps.

  • OS / runtime drift—the two gateways run on different platforms. Direct Access has historically been Windows-only, on the .NET 8.x runtime; from v1.8.0 (Sept 2026) it can alternatively be deployed as a Docker container on Linux or Windows, as an addition to—not a replacement for—the Windows install. The Data Movement gateway runs on a Qlik-certified Linux (RHEL 8.x / 9.x or Amazon Linux 2023). Inventory each host against its own platform baseline, and record which Direct Access hosts are native-Windows vs. containerized since they have different backup and driver-installation paths.
  • Driver / DSN inventory—Per-connector ODBC drivers and 64-bit System DSNs must match across every host in a Dev / UAT / Prod set.
  • TLS / proxy—TLS-intercepting proxies and Qlik Cloud Government require the --ca_bundle_path install flag; everyone else must leave it off.
  • Time / clock—NTP is required. Clock skew silently drops the mTLS tunnel.
  • Key-pair lifecycle—Each gateway registers a key pair against a non-disposable space. Re-image and DR restore both require regenerating the key and re-registering. From v1.8.0, Direct Access also supports automatic gateway registration from the command line, without going through the admin console—useful for scripted host rebuilds and multi-tenant / unattended deployments; console-based registration remains fully supported.
  • Log retention—Rolled-log disk fill on the host is a common admin housekeeping miss; the host isn't in Qlik Cloud's monitoring.

Tasks

Task TA AA DA AuA
Direct Access (Windows): confirm the host runs the .NET 8.x runtime; if on .NET 8.0.21+, apply the 127.0.0.1:0 / [::1]:0 binding fix or pin to .NET 8.0.20 ✓
Data Movement gateway (Linux): confirm each host runs a Qlik-certified OS—RHEL 8.x / 9.x or Amazon Linux 2023 ✓ ✓
Inventory installed ODBC / database drivers on every gateway host; confirm 64-bit System DSNs match across Dev / UAT / Prod hosts ✓ ✓
Verify NTP is running and host time is within tolerance of the tenant region ✓ ✓
Confirm outbound network allowlist (HTTPS / 443) includes <tenant-id>.<region>.qlikcloud.com. Direct Access also uses WSS over the same 443 connection—no extra port is needed, but Qlik calls WSS out as a distinct protocol, so any L7 / protocol-aware proxy must explicitly allow it. For Qlik Talend Cloud Remote Engines, also allow storage.<region>.cloud.talend.com (replaced minio.<region>.cloud.talend.com in November 2025) plus the region-agnostic Talend hosts ✓ ✓
Review log directory size and rolled-log handling on each host; rotate or archive before disk fill ✓ ✓
Document the re-registration runbook for host rebuilds (new key generation, service restart, registration against a non-disposable space) ✓ ✓
If corporate proxies intercept TLS, install with --ca_bundle_path pointing at the corporate CA bundle. Otherwise do not use --ca_bundle_path—supplying it without a TLS-intercepting proxy or Qlik Cloud Government trust chain leaves the gateway Disconnected ✓ ✓
Maintain Dev / UAT / Prod gateway segregation per Qlik recommendation; don't share a single gateway across environments ✓ ✓
For each Direct Access host, record whether it is the native Windows install or a v1.8.0+ Docker container; for EC2-hosted containerized gateways evaluate whether AWS PrivateLink (see Review allowlists and web integrations) should replace the public HTTPS/WSS allowlist entry for that host ✓ ✓

Gotchas

  • .NET 8.0.21 (and later 8.0.x) break dynamic-port binding on Direct Access. The October 2025 .NET 8.0.21 patch ships the CVE-2025-55315 Kestrel hardening, which breaks dynamic-port binding when the gateway uses localhost:0. Workarounds: bind explicitly to 127.0.0.1:0 / [::1]:0, or pin the host to .NET 8.0.20 until Qlik ships a gateway build that uses the new binding form. (community)
  • .NET 6.0.x is no longer required from Direct Access v1.6.8. The gateway runtime uses .NET 8.x, installed automatically during upgrade. (.NET Framework 4.8 is still needed for the installer itself, per the Direct Access upgrade page.)
  • Data Movement gateway certified OS list is short. Qlik certifies RHEL 8.x / 9.x and Amazon Linux 2023. RHEL-compatible rebuilds (Rocky, AlmaLinux, Oracle Linux) fall under the corresponding and compatible Linux distributions clause but aren't named in Qlik docs. FIPS-mode Linux hosts are unsupported. CentOS 7 is past Qlik's certified baseline.
  • TLS-intercepting proxies and Qlik Cloud Government require --ca_bundle_path; everyone else must NOT use it. Supplying the flag without an actual TLS-intercepting proxy or QCG trust chain leaves the gateway permanently Disconnected. (community)
  • REST connector to localhost is enabled per-connection on Direct Access 1.7.6+ via Allow working with localhost connection in the connection settings—that release added support for the REST (via Direct Access gateway) connector to reach local API endpoints. A gateway-wide override (REST_ALLOW_LOCALHOST_CONNECTION=true in C:\ProgramData\Qlik\Gateway\configuration.properties, then restart the Qlik Data Gateway - Direct Access service) is community-documented but the per-connection toggle is the help-center-supported path. (community)
  • Service account. The Direct Access service runs as LocalSystem by default. From 1.7.4+ the setup wizard and silent installation support overriding the default Windows service account; custom accounts are maintained across upgrades and need Log on as a Service and Write permission on the gateway installation folder. (Applies to the native Windows install; not applicable to containerized deployments.)
  • Direct Access v1.8.0 (Sept 2026) headline changes, affecting host-operations planning: containerized deployment on Linux or Windows via Docker (Windows install remains fully supported, this is additive); automatic gateway registration from the command line; AWS PrivateLink support for EC2-hosted gateways (GA—see Review allowlists and web integrations for constraints); a configurable timeout for the File connector's initial download acknowledgment; and updated OpenSSL / libcurl libraries across bundled ODBC drivers.

Automation helpers

  • Alert Qlik Talend Data Integration server license expiring within X days—License-expiry tracking for Data Movement gateways used by Talend.

References

Tags: #monthly #data_integration #data_gateways #host_operations #odbc #runtime

Did this page help you?

If you find any issues with this page or its content – a typo, a missing step, or a technical error – please let us know!

Leave your feedback here