This message was deleted.

@kelvin You do have it backwards. All traffic is initiated from the pxp-agent to the Orchestrator, a behavior we rely on. The exception is any agentless systems/jobs (which need to connect from the primary server directly to the target on the SSH/WinRM ports, e.g. to install an agent) - but we don't use that so I am just speaking based on what I've read.