---
title: "Pushing Software to AppGate Remote Users - NO SNAT"
slug: "pushing-software-to-appgate-remote-users-no-snat"
description: "Learn how to configure SCCM with AppGate for software updates using SNAT or NO-SNAT, ensuring seamless communication with remote users."
updated: 2025-12-07T01:19:10Z
published: 2025-12-07T01:19:10Z
canonical: "support.appgate.com/pushing-software-to-appgate-remote-users-no-snat"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.appgate.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Pushing Software to AppGate Remote Users - NO SNAT

With AppGate you can configure SCCM or any similar tools to push update/software via down Entitlement. The key difference here is whether you are using SNAT or NO-SNAT, this article will explain both scenarios. Before we dive into AppGate configuration, we assume that readers have proper knowledge about SCCM and have configured it correctly.

## NO-SNAT Site

![](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/pushing-software-to-appgate-remote-users---no-snat-image-sh5aeoy2.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A11%3A15Z&se=2026-10-27T03%3A11%3A15Z&sr=c&sp=r&sig=UqQsx2e7iUpX8hVhgJvAyZG%2BtJVWccJRi5FE6Rf3ojE%3D)

**In this scenario we have the following configuration**

1. No SNAT is configured in SCCM Site.
2. IP Pool of **192.168.1.0/24** has been configured and attached to the proper IdP.
3. Proper route to allow the **IP pool (192.168.1.0/24)** to communicate with **SCCM** **(192.168.42.3)**
4. Always-On client, Full client or Headless client is installed on the end user machine and has a Policy which contains the below Entitlements.

- **ALLOW UDP** up port 53 towards your DNS
- **ALLOW TCP down from** the **SSCM server 192.168.42.3** on port **80**

This will basically allow SCCM server to talk back to the remote users.

- **ALLOW TCP UP** to the **SCCM server 192.168.42.3** on port **80,10123**

So, when client logs in should have something like the following: ![](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/pushing-software-to-appgate-remote-users---no-snat-image-uerc56b4.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A11%3A15Z&se=2026-10-27T03%3A11%3A15Z&sr=c&sp=r&sig=UqQsx2e7iUpX8hVhgJvAyZG%2BtJVWccJRi5FE6Rf3ojE%3D) **Notes**

1. On the SCCM side a boundary group of IP address range 192.168.1.1-192.168.1254 has been created and attached to the proper DP.
2. The remote machine is domain joined machine; hence the IP tunnel address will be registered in the DNS and SCCM server can resolve the remote machine name correctly.
3. The SCCM connection uses http hence the required port is 80, if it is HTTPS then port 443 will be required as well.
4. In the case you are not sure which port needs to be opened, then the best way is to check Kibana Audit log and see if there are any drop packets.

For example, below you can see that the GW was dropping port 10, 123 with UP direction. Once those ports were added, everything started working as it should. ![](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/pushing-software-to-appgate-remote-users---no-snat-image-81e75rnf.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A11%3A15Z&se=2026-10-27T03%3A11%3A15Z&sr=c&sp=r&sig=UqQsx2e7iUpX8hVhgJvAyZG%2BtJVWccJRi5FE6Rf3ojE%3D)

1. For troubleshooting purposes, you can create an ICMP down Entitlement and attach it to the client Policy to make sure that SCCM server can reach the client. At the end, the remote user client session is looking as below:

![](https://cdn.us.document360.io/e7482ce5-acfa-4c3b-b76c-b6c32472644a/Images/Documentation/pushing-software-to-appgate-remote-users---no-snat-image-jhm0bxmh.png?sv=2026-02-06&spr=https&st=2026-10-27T02%3A11%3A15Z&se=2026-10-27T03%3A11%3A15Z&sr=c&sp=r&sig=UqQsx2e7iUpX8hVhgJvAyZG%2BtJVWccJRi5FE6Rf3ojE%3D)