---
title: OpenLM Router system requirements
description: Host, datastore, network, and OpenLM Platform requirements for deploying OpenLM Router, plus the license and encryption key you need.
product: OpenLM Platform
---

To deploy OpenLM Router, prepare a single Linux host inside your network, close to the license servers it fronts. The Router runs as a set of containers on that host. Confirm the following before you deploy.

## OpenLM license

Your OpenLM license must include the Router. In OpenLM Platform, open the license summary at `https://<your-platform>/licensemanager/#/license-summary` and look for the Router feature. A license issued before the Router existed does not include it.

Without the feature, **LicOps Configuration**, where you define failover pairs in OpenLM Platform, still opens. Each page then shows the following notice instead of its content, and saves are refused:

"Router License is not available with current openLM License, please contact with support team for more information."

The notice ends with a link to your OpenLM license information. If OpenLM Platform cannot reach the OpenLM LicenseManager to check the license, the pages show the following notice instead, and configuration stays read-only until the check succeeds:

"The Router license check could not be completed: the OpenLM LicenseManager is not reachable. Configuration is read-only until it answers."

A Router that is already configured keeps running and failing over without the feature. Only changes to its failover pairs are refused. Contact OpenLM to have your license reissued.

## Host requirements

The host must meet these requirements:

- A 64-bit Linux host. Windows hosts are not supported.
- Docker Engine 20.10 or higher, with the Docker Compose v2 plugin. Confirm with `docker compose version`.
- Either processor architecture, `linux/amd64` or `linux/arm64`. The Router images are published for both.

The Router itself is small. Size the host for the datastores and for the license traffic passing through it rather than for the proxy. The following table lists the CPU, memory, and disk resources:

| Resource | Minimum | Recommended |
| --- | --- | --- |
| CPU | 2 vCPU | 4 vCPU |
| Memory | 2 GB | 4 GB |
| Disk | 10 GB | 20 GB or more |

## Datastores

The Router needs MongoDB and Redis. You can run them as containers beside the Router or point it at servers you already operate. The following table lists the supported versions:

| Datastore | Version | What it holds |
| --- | --- | --- |
| MongoDB | 7.x | The routing configuration and the failover history. A single node is fine. |
| Redis | 7.x | Which server each pair is serving from, and the background job schedule of the Router. |

### Redis persistence is required

Configure Redis with append-only persistence and no eviction:

```text
appendonly yes
appendfsync everysec
maxmemory-policy noeviction
```

Both settings prevent a silent failure, and neither is optional.

`maxmemory-policy noeviction` protects the record of which server each pair is serving from. That key has no expiry by design, because it is the only record of the role. If Redis evicts it, a pair that had failed over quietly reverts to its primary, and a license server that is genuinely down starts receiving traffic again.

Persistence protects the job schedule of the Router. The Router registers its recurring jobs, including the OpenLM Platform health sync, only at startup. If Redis comes back empty while the Router keeps running, those registrations are gone: health data stops refreshing and failover stops working, with no error raised. The only visible symptom is that requests for the OpenLM Platform server list begin returning `503`. Restarting the Router restores the schedule.

Redis Cluster is not supported.

## Network requirements

The following table lists the network connections the Router needs:

| Direction | Destination | Purpose |
| --- | --- | --- |
| Outbound from the Router host | Your OpenLM Platform, over HTTPS | Server health, the license server list, and the Router configuration. |
| Outbound from the Router host | Each license server's `lmgrd` port, the port in `port@host`, typically `27000` | The proxied license traffic. For a FlexLM triad, open the port on all three machines: the Router also checks them itself. |
| From workstations | Each license server's vendor-daemon port, on the primary and the backup | The second leg of every checkout. The Router carries the client's first connection, to `lmgrd`, and the client then connects to the vendor daemon directly. Fix the vendor-daemon port in each license file with `PORT=` on the `VENDOR` line, so you can open it in the firewall. |
| Inbound to the Router host | The listen port of each failover pair | FlexLM clients reach the Router here. |
| Inbound to the Router host, from your administration network only | Ports `8100` and `8101` | The REST API of the Router, and the Router UI you use to connect the Router to OpenLM Platform. |

:::warning[Keep the administration ports on your administration network]
Ports `8100` and `8101` are administration interfaces. Allow access to them only from your administration network, and do not publish them to the internet. Publish only the license ports your clients use.
:::

## OpenLM Platform prerequisites

Before you deploy, confirm the following in OpenLM Platform:

- **Broker on each license server**: Each license server in a pair, the backup as well as the primary, is monitored by OpenLM through the OpenLM Broker. OpenLM Platform knows a license server, and its health, only through the Broker installed on that machine, so a server without a running, approved Broker never appears when you choose servers for a pair.
- **Access to LicOps Configuration**: You can open **LicOps Configuration** in OpenLM Platform. It is under **Licenses and Features** in the **Navigation** menu, and it is where you define failover pairs. You need an OpenLM Platform account with access to it, such as an account administrator.
- **Router client in Identity**: You can create a Router client in **Identity**. In OpenLM Platform, open **Identity**, select **Authorization**, and add a client whose **Client Type** is `Router`. You need its authorization file, or its **Client ID** and **Client Secret**, to connect the Router.

The client type is what OpenLM Platform grants permissions by. A credential of a different type can authenticate successfully and still be refused the queries the Router makes, which surfaces later as a missing server list rather than as a sign-in error. For the Router client steps, see [Configure OpenLM Router](https://www.openlm.com/documentation/cloud/deployment-operations/router/configuration#get-the-router-authorization-file).

### Prepare each license server

A backup server that serves no users is the one most likely to have no Broker. Check it before you build the pair. For each license server:

1. Install the OpenLM Broker on the license server machine.
2. Approve the Broker in **Broker Hub**.
3. Approve the license server under **License Servers**, then **Pending Servers**, with **Approve And Merge**.
4. Check that **Live Servers Statistics** in **License Servers** shows the server as **Up**.

For more information, see [Install Broker](https://www.openlm.com/documentation/cloud/getting-started/install-broker/), [Broker Hub](https://www.openlm.com/documentation/cloud/data-collection/broker-hub/), [Flexera FlexNet (FLEXlm)](https://www.openlm.com/documentation/cloud/data-collection/connect-license-managers/engineering-lms/flexera-flexnet-flexlm/), and [License Servers](https://www.openlm.com/documentation/cloud/slm/license-servers/).

## Encryption key

The Router encrypts the OpenLM Platform client secret before storing it. Generate a 32-byte key once per deployment:

```bash
openssl rand -base64 32
```

Keep the 44-character string the command prints. It decrypts credentials already stored in MongoDB, so replacing it does not rotate them. It makes them unreadable, and you have to enter the OpenLM Platform connection again.

Store the string exactly as `openssl` printed it. It is already the Base64 form of 32 random bytes, so running it through `base64` a second time produces a 44-byte value where 32 is expected, and the first save of the OpenLM Platform connection fails.

:::note[Next step]
Continue to [Deploy OpenLM Router](https://www.openlm.com/documentation/cloud/deployment-operations/router/deployment) to run the containers.
:::