0

One of our clients uses a rather strict firewall to restrict acces from external systems. We are trying to send data to one of their soap endpoints using apex.

This Stack exchange answer helped to get the IP adress of my requests like so:

HttpRequest req = new HttpRequest();
req.setEndpoint('http://icanhazip.com/');
req.setMethod('GET');
Http httpReq = new Http();
HttpResponse res = httpReq.send(req);
System.debug(res.getBody());

From 4 different orgs (2 scratch, 1 sandbox and 1 prod) a retrieve very different ip adresses (even betweens the requests), that are far away from the ranges inside this list. The sf instances are in Sweden or Germany, but the ips do not even apear outside the RIPE range.

Is there a chance, that this list only contains the IPs the salesforce webservers are linked to, but not to the apex servers in their cloud systems?

paloaltonetworks seems to maintain some SFDC lists with ip-ranges and domains but I wonder if domains do cover the apex server ips.

How shell we ask the client to open up their firewall for our requests, does it make sens to open up the domains instead or are they also just linked to the web servers? Any hint is appreciated!

4
  • 4
    You shall ask them to let the request through based on transport or envelope properties other than IP. Let them know it's 2024, not 1999.
    – identigral
    Commented Apr 12 at 15:16
  • 2
    see also this re: Hyperforce that you are on or soon will be: help.salesforce.com/s/articleView?id=000394078&type=1
    – cropredy
    Commented Apr 12 at 19:59
  • Thank you @cropredy, this reference contains a sheet, that actually contains the ips. I will forward the whole thing and mention the risks and concerns as well.
    – itsmebasti
    Commented Apr 15 at 9:11
  • ironically, I just got (2024-04-16) an email from SFDC (to sysads) telling me to update my Hyperforce IP addresses should we be using safelists (we're not). A perfect example of how SFDC says that Hyperforce IP addresses require vigilance and hence if you can avoid safelists, do so
    – cropredy
    Commented Apr 16 at 15:04

0

You must log in to answer this question.

Browse other questions tagged .