--- title: "Functions" slug: "functions-v6-5" description: "Explore the Functions tab for configuring appliances, including Controllers, Gateways, and LogServers, to enhance your AppGate setup." updated: 2025-10-31T18:25:54Z published: 2025-10-31T18:25:52Z canonical: "support.appgate.com/functions-v6-5" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.appgate.com/llms.txt > Use this file to discover all available pages before exploring further. # Functions This section describes the fields in the Functions tab. These fields may differ depending on the type of Appliance you are configuring. ## Appliance Functions Select the function(s) that you require for this appliance. > [!NOTE] > NOTE > > Only certain combinations of functions are allowed (for an appliance) by the smart list. ### Assign Functions #### Controller Provides authentication, authorization, and administration for the Collective. > [!NOTE] > NOTE > > A Controller can only be enabled on an active appliance. Create and activate a spare appliance first. Because the appliance is already activated, the first thing that happens when you enable the Controller function is a connectivity check. This checks port 443 to ensure full bidirectional connectivity exists between all existing Controllers and the candidate Controller. If the checks fail, a warning is shown and the connectivity issue must be resolved before trying again. If the checks pass, the form can be saved and the task of adding the new Controller begins. When adding a Controller - initially there may be an error shown in the dashboard - if you click refresh after 10 seconds this should be cleared and then you can see better the status of the add process. See [HA](/v1/docs/high-availability-ha) for more information about how to configure highly available Controllers. #### Gateway Provides secure access to a given Site. Multiple Gateways can be deployed per Site. See [HA](/v1/docs/high-availability-ha) for more information about how to configure highly available Gateways. #### LogServer Provides a local log server for use within the Collective. Once enabled, you will need to sign-out and sign-in before the Audit Logs tab appears in the admin UI. Appgate SDP includes a built-in LogServer function, using OpenSearch. The LogServer is an appliance that collects logs from the other members of the Collective, providing an audit trail of actions and user access. Only one LogServer can be deployed therefore HA configuration is not supported. It’s primary use case is to help customers during initial set up, configuration, evaluation and during initial deployment. It is also suitable for use in production environments for certain smaller scale deployments. The LogServer is not included in the base appliance image - so when this is enabled the required image will be automatically downloaded from a public container registry. The Controller will check that access to this registry is available when you save the configuration. To pass this check, you need to make sure the appliance where you are enabling the LogServer has access to https://public.ecr.aws on port 443. It is also possible to use sdpctl to do the download for you - so the creation of a LogServer is still possible even in a locked-down type of environment. To do this: - Download the zip file with sdpctl by doing: `sdpctl appliance functions download LogServer` - SCP the file up to the appliance. - On the appliance, run: `arc image import /home/cz/image.zip` - Enable the LogServer function on the appliance. The LogServer's operational limits for production environments are detailed in [Audit Logs](/v1/docs/audit-logs) where there is also more information about using a LogServer. #### LogForwarder Provides a means of collecting, grouping and securely distributing audit logs within an enterprise environment. If you have started using the LogServer (maybe on the Controller) during initial deployment and now want to migrate to a different appliance (LogServer or LogForwarder) - this can be done seamlessly without loosing any existing audit logs. If you are migrating from LogServer to your first LogForwarder then afterwards you will be able to add additional LogForwarders either for HA operation or because you want to distribute audit logs differently according to the Site. See [LogServer migrations](/v1/docs/advanced-logserver-migrations) for instructions. LogForwarders can be configured for HA operation using two or more appliances. They can be deployed to export the logs by Site to different destinations. Multiple export protocols can be specified at the same time including one for the ELK stack. This means that if there is an ongoing requirement to retain the ELK stack (effectively a copy of the LogServer) in an enterprise environment then one can be deployed outside of the Appgate SDP Collective (for example, running in AWS) and the logs forwarded there whilst also exporting the log data into an enterprise-class logging system. See [Audit Logs](/v1/docs/audit-logs) for more information about using a LogForwarder. > [!NOTE] > **NOTE** > > You cannot operate a LogServer and LogForwarders within the same Collective. #### Connector Extends connectivity to remote sites and unmanaged resources without requiring the use of a stand-alone Client. See [HA Connectors](/v1/docs/connectors) for more information about how to configure HA. The Connector is available in two configurations: **Express** allows one Policy to be defined that connects down to local resources from the associated Site; **Advanced** allows multiple Policies to be defined for groups of local resources that connect up and down to one or more Sites. Express and Advanced may be configured on the same appliance. When this is done the Entitlement(s) for the Advanced Connector Clients should contain ONLY up rules and NOT down rules. #### Portal Hosts a web frontend allowing clientless access for multiple users without requiring the use of a stand-alone Client. Appgate SDP's Portal appliance provides zero-install browser-based access to protected resources, with comparable security to the full Client. From the user's perspective, there is no need for any installation or set-up processes, just having a modern browser is enough for secure access. The Portal can be used in addition to or instead of the full Client. In this version it is recommended to be used to give zero-install secure access to a few internal resources for third party consultants. Future versions will be enhanced to provide secure access for remote offices or employee groups that only needs access to web based resources. Only minimal changes to the configuration of the Appgate SDP system are required for users to utilize the Portal. See [Portal](/v1/docs/portal) for more information about how this function works, it's specific DNS requirements and recommendations on how to deploy one. #### Metrics Aggregator Provides a means of collecting, grouping and securely exporting Prometheus metrics for an enterprise environment. Prometheus metrics can be exported from individual appliances. The Metrics Aggregator avoids the need to configure this function on numerous different appliances as well as avoiding the need to configure firewalls to allow inbound access to to every appliance. All appliances sending metrics will need to be able to connect to the Metrics Aggregator (like a Controller). See [System Monitoring and Logs](/v1/docs/system-monitoring-and-logs) for more information about Prometheus. After selecting a function, you will configure the required options that appear. These options are describedin the following sections: [Admin/API TLS Connection](/v1/docs/adminapi-tls-connection) [Customize Sign-in Page](/v1/docs/customize-sign-in-page) [External Log Settings](/v1/docs/external-log-settings) [High Availability Configuration](/v1/docs/high-availability-configuration) [HTTPS Settings](/v1/docs/https-settings) [Internal Log Settings](/v1/docs/internal-log-settings) [Resource Group Configuration](/v1/docs/resource-group-configuration) [Secure Tunnel Settings](/v1/docs/secure-tunnel-settings) [Site Settings](/v1/docs/site-settings) [System TLS Connection (using SPA)](/v1/docs/system-tls-connection-using-spa) [User Access Settings](/v1/docs/user-access-settings) [Prometheus Exporter Settings](/v1/docs/prometheus-exporter-settings) The virtual or physical instance on which the system is running. Each appliance is a stateless, configurable machine that can operate as a single function or a combination of functions. The Controller is the central management appliance in the Appgate ZTNA system, responsible for user authentication, policy distribution, and overall system administration. An appliance that acts as an enforcement point, controlling user access to protected resources. Appgate SDP (Software Defined Perimeter) is a security solution that provides secure access to resources based on user identity and context, leveraging a zero trust security model. A component that extends connectivity to remote sites and unmanaged resources without requiring the use of a standalone Client. A Policy is a set of rules that govern access control and permissions for users and devices within the Appgate ZTNA system. Policies determine what resources users can access based on their entitlements. A defined access right or permission granted to users or devices, allowing them to access specific resources or functionalities within the Appgate ZTNA system. A web-based interface that allows users to access resources without requiring a standalone Client. It serves as a reverse proxy for user traffic.