Configuring a new traffic isolation packs (TIP)

[DavitH]

We are trying to separate high-volume proxies into a separate TIP.  Apigee team has provisioned a new TIP and asked us to whitelist the EIPs for the pods.

What is the whitelisting process?
Where exactly does it have to be done?

An architecture diagram showing routers, firewalls, TIPs, etc, would be helpful.

Thanks in advance!

[kurtkanaskie]

Nothing has to be done. With the TIP installed you will get a list of static IP addresses that Apigee will use for southbound communication. If you choose, you can set these IP addresses into an allow-list on your side to only allow those IPs access into your backends. This would be done by your network admin on whatever solution you use to protect your network.  You are not required to do this, though. 

You can view your IPs using an Edge API, for example:

curl -H $AUTH https://api.enterprise.apigee.com/v1/organizations/$YOUR_ORG/eips
{
  "podEips" : [ {
    "eips" : [ ],
    "pod" : {
      "name" : "agea1rt001-1",
      "region" : "us-east1"
    }
  }, {
    "eips" : [ "35.237.42.121", "35.231.238.30" ],
    "pod" : {
      "name" : "agea1mp000-5",
      "region" : "us-east1"
    }
  } ]
}

I've not been able to pinpoint the docs for this.

[DavitH]

Thank you @kurtkanaskie