Spok Go Environment
- Last updated
- Save as PDF
On-Premises Gateway
Overview
The on-premises gateway provides the secure, encrypted connection to Spok Go from on-premises systems including Spok products like Smart Suite, Spok Console, MediCall and Spok Messenger as well as other systems like EHRs and nurse call systems. The gateway is a thin application that moves data from the on-premises systems to the cloud. The gateway requires a minimum of three VMs (virtual machines) behind the customer's firewall. The VMs are then clustered for high-availability, redundancy and resiliency.
The gateway is deployed as a cluster of 3 redundant VMs and because it is the “thin application” that was mentioned before, it can continue functioning even after the possible loss of 2 VMs. To help ensure better resiliency in the event of unforeseen issues, the VMs on which the gateway is installed can reside on different virtualization servers so that the loss of a server does not affect all of a Gateway’s VMs. To further insulate the gateway’s continued operation from the unexpected, the virtualization servers that are used can even exist in different data centers (provided there is little-to-no network latency between the data centers that are involved).
You can add additional gateways if a site has multiple data centers or needs high throughput for messaging. A tenant can have multiple gateways, but a gateway can point to only one tenant. However, to allow the virtual machines to create a server cluster, there must be an odd number of virtual machines. An even number of machines will not allow a leader machine for the server cluster. Spok recommends one gateway (set of three virtual machines) per data center or console/middleware system.
Each virtual machine should be allocated the recommended disk space, memory, and processor. To help ensure performance and throughput, ensure other applications on the VM do not use or limit these resources.
Gateway Requirements
The customer must provide the following for the gateway:
| Requirement | Details |
|---|---|
| Virtualization Software/Hypervisor |
VMWare The on-premises Gateway’s installation package is distributed as an OVA file using the OVA standard. While VMWare is the only Virtualization Software/Hypervisor that has been tested thus far, any Virtualization Software/Hypervisor that supports installations via the OVA standard resulting in Ubuntu VMs should suffice. |
| Virtual Machines |
A minimum of 6 (3 for production tenant and 3 for the test tenant) with the following:
|
| Load Balancer | A load balancer such as HAProxy is needed to manage the traffic for both production and test gateways. For more information, see Preparing for Spok Go > Load Balancer. |
Gateway Software
The table below lists the software that is included with the gateway:
| Software | Details |
|---|---|
| Operating System | Ubuntu1 |
| Gateway Components2 | Containerized software components for connectors that enable integration with on-site systems. These include Spok systems such as MediCall, Spok Messenger, Spok Console, and Smart Suite, as well as other on-site systems like EHRs, Lab and Radiology systems, Nurse Call systems, and similar. |
- This operating system is included as part of the gateway installation and does not need to be provided by the customer. Spok will automatically install and perform any security or maintenance updates to the operating systems on the virtual machines on a weekly basis. The security and maintenance packages that are installed are retrieved directly from Ubuntu’s default package repositories. In order to ensure uptime, these packages are applied to one virtual machine at a time so that if a restart of a service or a virtual machine is necessary, the other two instances of the Gateway will continue to be available to service any message, alarm or other Gateway traffic.
- Spok will automatically install and perform any updates to the Gateway components on an as-needed basis. The updates that are installed are retrieved directly from the Spok Go Platform in AWS. In order to ensure uptime, these updates are applied to one virtual machine at a time so that if a restart of a service or a container is necessary, the Gateway software that is running on the other two instances of the Gateway will continue to be available to service any message, alarm or other Gateway traffic.
Supported Browsers
Use one of the following browsers (current version and one version back):
- Apple Safari
- Google Chrome
- Microsoft Edge
- Mozilla Firefox
Supported Operating Systems
| Operating System | Version |
|---|---|
| Android | Android 11, 10, and 9 (Pie) |
| iOS | iOS 15 and 14.7 |
| Windows |
Windows 8 (32-bit) Windows 8 and 10 (64-bit) |
Supported Devices
Spok has internally validated Spok Go support for the following devices and includes support for device-specific OS versions.
Third-party device manufacturers may offer additional support validation for Spok Go on their devices. This table will be updated with third-party support information as it becomes available.
| Make | Model |
|---|---|
| Apple | iPhone (currently supported iOS versions only) |
| Honeywell | Dolphin CT Series |
| Spectralink | PIVOT and Versity |
| Zebra | TC51-HC, TC52 |
The Zebra MC40 device is not supported.
Firewall Requirements
The Spok Go application is dependent on communication between on-premises Gateways, workstations, smartphones and tablet devices within a customer’s network, and Spok’s AWS hosted environment. A customer’s internal intranet as well as their firewall must allow access (also known as whitelisting) to several URLs in order to facilitate the exchange of information via the Internet.
There are millions of public IP addresses contained within the AWS infrastructure – any of which can change at the discretion of AWS. Because of this, Spok Go strongly discourages any attempt to manage a customer’s intranet/firewall access via whitelisted IP addresses. Instead, using the URLs that are defined below will eliminate the need for possibly frequent, even unexpected configuration changes if any of the underlying IP addresses change.
Please note that if these firewall changes are not performed, Spok Go cannot function.
Allowing Outbound Access by URL
- *.spokgo.com (all customers)
- *.spokgo.ca (Canadian customers)
- *.spokgo.com.au (Australian customers)
- *.amazonaws.com (for initial Gateway activations, The <region> will be provided by your implementation consultant)
- ssm.<region>.amazonaws.com
- ssmmessages.<region>.amazonaws.com
- ec2messages.<region>.amazonaws.com
- ssm.<region>.amazonaws.com
- index.docker.io
- hub.docker.io
- auth.docker.io
- archive.ubuntu.com:80 (for gateway OS updates)
- *.datadoghq.com:10516 (for Gateway monitoring)
If you have enabled firewall rules based on the URLs, you do not need to make any changes. As Spok migrates the URLs to new IP addresses by updating the DNS (Domain Name System) records, your systems and devices automatically connect to the new systems.