Reverse Invoke in API Gateway
This section explains what is reverse invoke and how it works in API Gateway.
What is Reverse Invoke?
The reverse invoke flow is as follows:
1. External clients send the API requests to the API Gateway Standard Edition Server in the DMZ.
2. The API Gateway Standard Edition Server collects client information from each request and evaluates the request against any rules that is defined. Those requests, which do not violate a rule are passed to the API Gateway Advanced Edition server.
3. The API Gateway Advanced Edition server processes the requests and sends the responses to the API Gateway Standard Edition Server.
4. The API Gateway Standard Edition server then forwards the responses back to the client.
How does Reverse Invoke work?
1. API Gateway Standard Edition server uses an external port to listen to the API requests from external clients.
2. API Gateway Standard Edition server maintains its connection with the API Gateway Advanced Edition server through a registration port. For security purposes, the API Gateway Advanced Edition server initiates the outbound connections to the registration port.
3. By limiting the connections to just those established by the API Gateway Advanced Edition server, this arrangement makes it difficult for attackers to directly penetrate the internal network, even if they subvert a system in the DMZ.
4. For maximum benefit, Software AG highly recommends that you configure the inner firewall to deny all inbound connections. With this configuration, you isolate the servers on the corporate network from the DMZ. This capability is the main advantage of using API Gateway Standard Edition server over traditional third-party proxy servers.
Note:
The reverse invoke method is used in
Paired Deployment. For more information on paired deployment setup, see
Paired Deployment 
