Network Connectivity Requirements for On-prem Environment
To install and use the Windchill AI Assistant plugin, you must configure the network allowlist on the Windchill instance to allow outbound connectivity to the required DNS endpoints and ports.
• For communication with Azure services, allow outbound HTTPS (port 443) connections to the following domains:
◦ ${DEPLOYMENT_NAME}-ai-search.search.windows.net
◦ ${DEPLOYMENT_NAME}-ai-foundry.cognitiveservices.azure.com
◦ ${DEPLOYMENT_NAME}-ai-foundry.services.ai.azure.com
◦ ${DEPLOYMENT_NAME}.blob.core.windows.net
• To log in to or access the PTC SaaS Platform during plugin installation, allow outbound HTTPS (port 443) connections to the following services:
◦ ptc-atlas-prod.us.auth0.com
◦ login.microsoftonline.com (if Microsoft SSO is used)
◦ creo.portal.ptc.com
• To install the plugin from the PTC plugin distribution service, allow outbound HTTPS (port 443) connections to the following endpoints:
◦ creosaasprodcdn.azureedge.net
◦ creosaasprodstorage.blob.core.windows.net
Proxy Configurations
If your network uses a proxy for inbound or outbound connections, you may need to apply one of the following configurations, depending on your environment:
1. Proxy without TLS inspection:
◦ Set export HTTPS_PROXY=http://<address>:<port> on the server running the plugin.
With this configuration, the proxy displays metadata only for all plugin connections.
2. Proxy with TLS inspection, with an exception for the Windchill server:
◦ Set export HTTPS_PROXY=http://<address>:<port> on the server running the plugin.
With this configuration, the proxy displays full content (full flows) for plugin‑to‑Azure connections, and metadata only for plugin‑to‑Windchill connections.
3. Proxy with TLS inspection and no exceptions:
◦ Set export HTTPS_PROXY=http://<address>:<port> and export NO_PROXY=wcserver.internaldomain.com on the server running the plugin.
With this configuration, the proxy displays full content (full flows) for plugin‑to‑Azure connections. Plugin‑to‑Windchill connections bypass the proxy and are not visible on the proxy.