AI Agent Frontdoor series — Post 3 of 6
At A Glance
- Each new agent arrives as another inbound rule, another DMZ change, and another allow-list to maintain.
- Vendor IP ranges drift, so allow-lists are a standing operational burden with a security gap built in.
- Connectors beside each system dial outbound, so there is no inbound port, no public DNS record, and no firewall change.
- The identity-based fabric carries overlapping and private IP ranges without re-addressing.
In this series
The prior post walked the options for connecting a vendor’s AI agent to an internal system and showed why each one trades away exposure, portability, or control. This post is for the team that lives with those trades day to day: network services and third-party connectivity. You own the firewall, DNS, the DMZ, and the allow-lists, and every AI agent the business signs lands on your desk as work.
The ticket that never ends
The pattern is familiar. A program team buys an agent, the agent needs to reach an internal system, and the request becomes a firewall change, a DMZ entry, and a public DNS record. Then the next agent arrives, and the next. Each one is a change window, a review, and a new rule that lives forever. The work does not end, because the business keeps buying agents, and every one of them points inbound at something you have to open.
Why allow-lists of vendor IPs are a losing game
Restricting an exposed system to a vendor’s IP ranges feels like control, and it erodes on its own. Vendors add regions, rotate addresses, and move to shared infrastructure, so the list drifts out of date between reviews. A stale entry is either a broken agent or an open gap, and you cannot tell which without checking. You end up maintaining someone else’s address space as a condition of your own security, and the system is still reachable from every address on the list.
Outbound by default
NetFoundry Frontdoor changes the direction of the connection. A connector sits beside each internal system and dials outbound to the fabric. The vendor’s agent reaches the system through that fabric, and nothing ever connects inbound to you. There is no port to open, no DMZ entry to create, and no public DNS record to publish. The system is dark to the internet, and it still answers the agent that policy allows. Your inbound rule set for AI agents stops growing, because there are no inbound rules to add.
No DMZ, no public DNS, no re-addressing
Because the connector dials out, the system needs no presence in the DMZ and no public name. The fabric authenticates every node with X.509 certificates and carries traffic over mutually authenticated, end-to-end encrypted channels, so the path is closed to anything without an identity. The identity-based model also handles overlapping and private IP ranges, including NAT, CGNAT, and RFC 1918 space, without re-addressing, so you are not renumbering networks to make an agent reachable.
What your change calendar looks like after
With the pattern in place, a new agent is a policy change, not a network change. You authorize an identity to reach a service, and the connectors already in place carry it. No change window for a firewall rule, no DMZ review, and no allow-list to update when the vendor moves an address. The network team approves the pattern once and stops being the bottleneck for every agent the business adopts. The next post turns to the security architect, who has to approve that pattern in the first place.
Read the rest of the series
Prior: Every Option Is a Bad Trade, why allow-lists, VPNs, tunnels, and Cloudflare fall short.
Next: Approve the Pattern Once, the security architect’s view.
Frequently Asked Questions
If there’s no inbound port, how does the agent reach the system?
A connector beside the system dials outbound to the fabric and holds that connection open. The agent’s request travels over the fabric to the connector, so traffic reaches the system without anything connecting inbound to your network.
Do we still need a DMZ for these systems?
No. The system needs no public endpoint and no DMZ presence, because it is never exposed to the internet.
What about overlapping or private IP ranges?
The identity-based fabric addresses services by identity, not by IP, so it carries overlapping, NAT, CGNAT, and RFC 1918 ranges without re-addressing.
Does this replace our firewall?
No. It removes the need to open inbound rules for AI agents. Your firewall stays in place for everything else, with fewer standing exceptions to manage.
