# Endpoint Security without using Fleet

**URL:** <https://discuss.elastic.co/t/endpoint-security-without-using-fleet/281802>\
**Category:** Endpoint Security\
**Tags:** fleet\
**Created:** [August 18, 2021, 10:05am UTC](https://discuss.elastic.co/t/endpoint-security-without-using-fleet/281802 "2021-08-18T10:05:17Z")\
**Posts on this page:** 1\
**Showing post:** 9

<div class="post-metadata">

**Author:** ![KevSex](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevsex/32/29031_2.png) [@KevSex](https://discuss.elastic.co/u/KevSex)\
**Post date:** [September 24, 2021, 6:52am UTC](https://discuss.elastic.co/t/endpoint-security-without-using-fleet/281802/9 "2021-09-24T06:52:57Z")

</div>

@blaker

How would one achieve this?

My current setup is as follows:

- Self-hosted
- 3-node Elasticsearch cluster (7.15.0)
- Kibana (7.15.0)

Fleet server URL: `https://kibana-dev.mydomain.com:8220`  
Elasticsearch URL: `https://kibana-dev.mydomain.com:9220`

A separate hosted environment consisting of two servers:

- Server-A (Static NAT with ACLs permitting `tcp/9200` and `tcp/8220` to above URLs)
- Server-B (Dynamic PAT with no access to above URLs)

A Demo policy has been configured with integration for:

- Elastic Endpoint Security
- System

Server-A has been enrolled successfully to the above policy and can see this under both, **Fleet \> Agents** and **Security \> Endpoints**. The agent statuses show as 'Healthy'.  
Server-A also has reverse proxy configuration in place for the above mentioned ports and I am able to hit these from Server-B.

When I attempt to enroll Server-B using below install command, the enrollment is successful:

`sudo ./elastic-agent install -f --url=https://Server-A-internal-IP:8220 --enrollment-token=xxxxxxx`

```auto
2021-09-24T07:28:53.704+0100 INFO cmd/enroll_cmd.go:414 Starting enrollment to URL: https://192.168.15.1:8220/
2021-09-24T07:28:55.227+0100 INFO cmd/enroll_cmd.go:252 Successfully triggered restart on running Elastic Agent.
Successfully enrolled the Elastic Agent.
Elastic Agent has been successfully installed.

```

After a couple of minutes, the status of Server-B changes from Healthy to Unhealthy and looking in the logs, I see this attempting to connect to the non-proxy URL which it cannot access (hence the reverse proxy config).

```auto
{
  "log.level":"error",
  "@timestamp":"2021-09-24T06:31:42.029Z",
  "log.origin":{
    "file.name":"fleet/fleet_gateway.go",
    "file.line":180
    },
  "message":"failed to dispatch actions, error: fail to communicate with updated API client hosts: Get \"https://kibana-dev.mydomain.com:8220/api/status?\": context deadline exceeded",
  "ecs.version":"1.6.0"
}

```

Am I doing something wrong or is this not achievable?

Appreciate your input.

Kev

---

_[View the full topic](https://discuss.elastic.co/t/endpoint-security-without-using-fleet/281802)._