Install Banyan Access Tier using Docker

Install the Access Tier on a server running Docker

  • Updated on Apr 27, 2022

This article describes features that are only available in the Banyan Enterprise edition.

Network Reachability Checklist

  1. The Access Tier server(s) should be located in your internet-facing DMZ and have a Public IP Address so it can be reached from anywhere on the internet.

  2. Configure a Public Wildcard DNS Record that follows your corporate domain name convention to map to the Access Tier’s Public IP Address
    • A common pattern is to use *
    • Then, corporate services can be exposed to your users as,, etc.

    If you’re deploying Access Tiers across multiple sites, you can further scope the subdomains into *, *, etc.

  3. Expose the following ports to the internet for use in inbound connections to the Access Tier:

    • Port 80 (HTTP)

      • Port 443 (HTTPS)

      • Port 8443 (for non-HTTPS TCP traffic such as SSH or RDP)

    • Port 51820 (for WireGuard service tunnel traffic over UDP)

  1. Ensure that Access Tier can make an outbound TCP connection to its Shield (Cluster Coordinator) to register with the Command Center, receive Policies, and send Event data. You can find the Shield Address for your Access Tier in the Cluster Settings page.

Shield Address - Infrastructure > Cluster

  1. Ensure that Access Tier can make an outbound HTTPS connection via Port 443 to the Command Center. If you use automated bootstrapping to configure the Access Tier, the install script will make an API call to https://{ccname}… to obtain a one-time-key required for installation.

  2. Ensure that Access Tier can make an outbound HTTPS connection via Port 443 to the Command Center TrustProvider component. In order to authenticate OIDC JWT tokens used for web access, the Access Tier will need to obtain JSON Web Key Set (JWKS) containing public keys from https://{orgname}

  3. Ensure your networking policies allow traffic to flow from the Access Tier server to backend machines running the applications and services you need to secure access to.

The netagent binary supports Egress Proxy settings, so the outbound connections from Access Tier can traverse your Egress Proxy as required.

Pre-install Checklist

  1. Ensure you have an Organization set up in Banyan and that you have admin access via the Command Center.

  2. In the Banyan Command Center, navigate to Infrastructure > Clusters and ensure you have a Cluster with a running Shield that the Netagent or Access Tier can connect to. The Clusters section of the Web Console lists all cluster parameters such as Cluster Name, Shield Address, etc.

  3. In the Command Center, navigate to User Settings > My Profile and ensure you have generated a Refresh Token. You will need your Refresh Token if/when you use the automated bootstrap scripts to install Netagent or Access Tier.

Refresh Token - My Profile


Before you start the Netagent docker container you need to specify its configurations. Set the environment variables on the Linux server on which you’ll be installing the container.

Note: Instead of using a Refresh Token, you can now create an API key using an Access Tier scope. For more detailed instructions on how to authenticate with an API key, refer to our API documentation.

# set env vars to connect to your Command Center account
export BANYAN_API=        # API path to Command Center, such as
export REFRESH_TOKEN=     # provided under Settings in your Command Center; Note: API keys can be used instead
export CLUSTER_NAME=      # specify the Cluster to register with
# set env vars to specify Access Tier parameters
export SITE_NAME=         # display name of Site secured by Access Tier
export SITE_ADDRESS=      # canonical domain name of the Site,
                          # ex: ""


docker run --privileged --cap-add=NET_ADMIN \
	   -v /dev:/dev -v /lib/modules:/lib/modules \
	   -p 80:80/tcp -p 443:443/tcp -p 8443:8443/tcp -p 51820:51820/udp \

If your server needs root privilege to run docker via the sudo command, remember to add -E so your environment variables get passed through. Your command will then look like sudo -E docker run ...

Banyan’s Netagent binary leverages Linux kernel networking, including IPTables, and WireGuard. The Docker container needs to be run in privileged mode with the NET_ADMIN capability to configure networking correctly.

Verify Installation

Once the Access Tier is installed, you can check its logs using docker logs to ensure it is functioning as expected.

You can check the Infrastructure > Sites section of the Banyan Command Center to see the list of all the registered Access Tiers.

Infrastructure - Sites

How to Upgrade Netagent in Docker


  1. Follow the same steps completed during installation. Ensure that you include the latest version of netagent in the last line of code:
docker run --privileged --cap-add=NET_ADMIN \
	   -v /dev:/dev -v /lib/modules:/lib/modules \
	   -p 80:80/tcp -p 443:443/tcp -p 8443:8443/tcp -p 51820:51820/udp \