Add and manage secure tunnels in the Polaris UI

Use Polaris Secure Tunnel, a feature of the Black Duck Bridge, to securely access web applications, APIs, and on-premises services in your private network. Secure tunnels are outbound-only encrypted connections from a machine inside a private network to Polaris, established by running Bridge with the polaris-secure-tunnel workflow. Use secure tunnels to access DAST targets (web applications and APIs), on-premise SCM servers, and integration URLs that are only accessible on a private network.

Prerequisites

Before you begin, make sure that you have:

Installed Bridge CLI version 4.3.0 or later. See Download the Bridge CLI.
Reviewed the Secure Tunnel system requirements. See Using Polaris secure tunnel.
Created an access token or service account token. See Make an access token and Service Accounts for Polaris for more information.

Add a secure tunnel

Create your secure tunnel in Polaris so it can be associated with internal DAST projects and on-premises SCM integrations.

Go to My Organization > Secure Tunnels.
Click Create Tunnel.
Enter a Name for the secure tunnel. You must reference this name when running the polaris-secure-tunnel workflow in the Bridge CLI.
(Optional) Enter a Description.
The description is displayed alongside the tunnel name in the tunnel list.
Click Save.

The secure tunnel is created with a status of Disconnected by default.

Run secure tunnel in the private network

After registering the tunnel in Polaris, run the polaris-secure-tunnel workflow from the Bridge CLI from a machine inside your private network. This process connects to the specified named Teleport instance in Polaris, downloads the Teleport agent and configuration, and then runs the Teleport agent to establish a secure TLS tunnel on port 443. The secure tunnel is then connected.

From your private network, run the Bridge CLI with the polaris-secure-tunnel workflow and specify the secure tunnel name you configured in Polaris.

See Create a secure tunnel using Bridge CLI in the Bridge CLI documentation for the full command syntax and options.

Confirm the tunnel is in a Connected state

Before using a secure tunnel with DAST projects or SCM integrations, confirm that the tunnel is active. Disconnected tunnels will block SCM bulk onboarding.

Go to My Organization > Secure Tunnels.
In the tunnel list, confirm that the relevant tunnel shows a status of Connected.
Note: A tunnel's status may take up to 20 minutes to update from Connected to Disconnected after a connection is closed.

Your secure tunnel is now ready to use. You can use it to access:

Internal DAST targets. See DAST configuration requirements.
On-premises SCM integrations, including:
- Bulk repository onboarding from GitHub Enterprise Server. See GitHub Enterprise Server.
- Bulk repository onboarding from GitLab Self-Managed. See GitLab Self-Managed.
- Event-based test automation. See Event-Based Test Automation in Polaris for SCM Integrations.
- Issue tracking integration. See Issue tracking integration for Jira Data Center.

Edit or delete a secure tunnel in the Polaris UI

You can rename or remove a secure tunnel from the Polaris tunnel list at any time.

Important: If you change a tunnel's name, you must restart the Bridge CLI workflow using the new tunnel name.

Go to My Organization > Secure Tunnels.
Locate the tunnel you want to modify and click the three-dot menu (...) next to its name.
Select Edit or Delete.