7

I wrote a REST service to call another system from Salesforce. They have firewalls up and such and I instructed them to Whitelist the Salesforce force suggested IPs at Salesforce IP Address to whitelist which is also the following:

204.14.232.0/23 East Coast Data Center (set one)
204.14.237.0/24 East Coast Data Center (set two)
96.43.144.0/22  MidWest Data Centers
96.43.148.0/22  MidWest Data Centers
204.14.234.0/23 West Coast Data Center (set one)
204.14.238.0/23 West Coast Data Center (set two)
202.129.242.0/23 Singapore Data Center
182.50.76.0/22 Japan Data Center

The return I am getting is:

<status type="Error" code="LoginError" message="Invalid stored procedure name ''." />

They asked me to get the exact IP Salesforce is calling from. From what I understand this isn't possible, but am I incorrect? If I am incorrect how do I find it?

  • 1
    This strikes me as similar to your previous question Rest HttpRequest to outside system. The Salesforce IP addresses can change, and you should use Salesforce IP Address to whitelist as a starting point. – Daniel Ballinger Nov 12 '14 at 20:58
  • @DanielBallinger It's definitely related, but the question I'm asking is clearly different. This is essentially a continuation on the last question. This question is assuming the answer from that question is correct and so looking to the next steps to try to drill down into the issue. – dphil Nov 12 '14 at 21:06
  • 1
    @DanielBallinger link broken. This works tho What are the Salesforce IP Addresses to whitelist? – bigassforce Nov 12 '14 at 21:22
  • @bigassforce Huh, I was sure that link was valid only a few days ago. Good catch, thanks. I've updated the link in the answer. – Daniel Ballinger Nov 12 '14 at 21:27
18

The Salesforce IP addresses can change, and you should use Salesforce IP Address to whitelist as a starting point.

With that taken into account, you can use an existing web service to tell you what the IP address is (for that request at least).

HttpRequest req = new HttpRequest();
req.setEndpoint('http://icanhazip.com/');
req.setMethod('GET');
Http httpReq = new Http();
HttpResponse res = httpReq.send(req);
System.debug(res.getBody());

Log output from na5.

10:09:49:424 USER_DEBUG [6]|DEBUG|204.14.234.8

Don't forget to add http://icanhazip.com as a remote site.

  • Perfect. I ran this call several times and it hasn't changed. This is exactly what I need. I do realize it can change and will test it daily to see if it changes to let the other team know. – dphil Nov 12 '14 at 21:20
  • 1
    Great. I found in another Stackoverflow question you can also ask for the IPv6 result as well if required using ipv6.icanhazip.com. I couldn't get it to work from my local machine, so I guess I don't have IPv6 networking to the internet. – Daniel Ballinger Nov 12 '14 at 21:22
5

All connections in or out will go through one of their published IP addresses. It could be any IP address in those ranges. Instances rarely change IP addresses, but they could do so at any time, so trying to whitelist a specific IP address may cause future connection errors. Internal load balancers may not guarantee which IP address is used on an outgoing request, and may even use multiple IP addresses per cluster if the internal proxies were reaching capacity. You should tell them that this list is what is officially recommended.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.