The numbers, paths, and limits.

The proxy terminates TLS and re-signs with its own CA. Where an agent pins or otherwise validates the expected certificate chain, the substituted certificate causes the connection to fail rather than degrade.

Reported as: Agents install successfully and then never check in, or check in from some network segments and not others. Reads as an agent bug; is a network control.

Ask them: “Do you perform TLS inspection on outbound traffic, and is there an existing bypass list for management and security agents?”

Basis: Standard behaviour for agents on an inspected egress path. Confirm the specific bypass requirement with NinjaOne support for the customer's configuration rather than asserting it.

A service running as SYSTEM has no interactive user credential to present. Proxies requiring per-user authentication will reject it even when the URL is allowlisted.

Reported as: Works when a technician tests it signed in, fails when it runs as a service. The most misdiagnosed network problem in endpoint management.

Ask them: “Does the proxy require authentication, and is there an unauthenticated bypass for machine-account traffic?”

Basis: General consequence of running under a machine context behind an authenticating proxy.

Because the agent needs only outbound 443 to the control plane and no route to the corporate network, it works on a split tunnel without being routed through the VPN — which is usually the desired outcome, since forcing management traffic through the tunnel consumes concentrator capacity for no benefit.

Reported as: Usually none. Worth raising proactively, because a network team assuming the agent needs the tunnel will size for traffic that does not need to be there.

Ask them: “Is the VPN split or full tunnel, and is there a reason management traffic should be forced through it?”

Control-plane hostnames may fall into an uncategorised or newly-registered-domain bucket and be blocked before any firewall rule is consulted. The connect-* rendezvous shards are the most likely to be missed because there are 72 of them.

Reported as: Console and agent work while remote sessions fail for an apparently random subset of devices — each device pins to a shard, so the affected set looks arbitrary from the outside.

Ask them: “What DNS filtering or web gateway is in path, and can we allowlist by domain there as well as at the firewall?”

Where an allowlist was written as IPv4 literals, an endpoint preferring IPv6 can bypass the permitted path entirely and be denied by a default rule.

Reported as: A subset of otherwise identical machines cannot reach the platform, frequently on a newer network segment.

Ask them: “Are any segments IPv6-enabled, and is the allowlist expressed as hostnames rather than IPv4 addresses?”

Basis: General consequence of IP-literal allowlisting. Hostname-based rules avoid it entirely, which is why they are the recommendation.

Documented gateway addresses exist for environments that cannot do hostname-based rules, but IP sets change over time and a static list becomes a maintenance obligation the customer owns.

Reported as: Works at deployment, degrades months later as infrastructure moves. The failure arrives long after anyone connects it to the firewall change.

Ask them: “Can you allowlist by hostname or wildcard? If IP literals are mandatory, who owns re-verifying that list, and how often?”

Where a third-party software vendor publishes update payloads only over anonymous FTP or HTTP, the agent may fall back to 21/FTP or 80/HTTP after repeated HTTPS attempts fail.

Reported as: Most patching works; specific third-party applications never update. Surfaces weeks later as a compliance gap nobody can explain.

Ask them: “Is outbound 21 and 80 permitted for patch payload retrieval, and if not, which third-party applications are in scope for patching?”