Isolation of Organization and IP Address

[#1]

HI there,

We are Apigee Edge cloud customer with multiple organization.

The IP address assigned for all the Organization are same.

As per PCI compliance, Prod and QA need have different IP addresses.

Am I missing some thing.

Are message processors share between Organizations?

Is IP address associated with Message Processor or Organization?

Is there a way to have different IP address for Differnt Org.

Thanks for your help.

[#2 · Accepted solution]

Hello @Pradeep Ande,

Please check my questions and answers:

1. The IP address assigned for all the Organization are same.

Q: Whose IP Address do you mean here?

2. Are message processors share between Organizations?

A: Yes. It is possible.

Is IP address associated with Message Processor or Organization?

A: Message Processor.

Is there a way to have different IP address for Differnt Org.

A: Would depend on answer of Question #1.

[mschreuder]

Hi @Pradeep Ande just a clarification on above:

Organizations are fronted by load balancers/routers, you don't hit message processors (MPs) directly. So when you configure a domain and resource path in Apigee and build and deploy a proxy, your API requests will actually land on a load balancer/router and the IP address(es) you see for that domain are of the load balancer(s)/router(s).

We have also recently made some changes and introduced a new Network Address Translation (NAT) component, you can read more about it here. When an MP sends an API request onto a target, it now does that via NAT. This also means that you won't see the traffic coming directly from an MP, instead you will see it coming from one or a small range of IP addresses for the NAT.