Are northbound IPs static?

[mark_hammelman]

Hello,

We have an enterprise account hosted in multiple regions on cloud. An application wants to call our services and has asked for a list of our IP addresses so they can whitelist them. For clarity, I am referring to our "northbound" connection from a client to Apigee.

I know I can use "nslookup" to see an IP address for my virtualhost, but since this is a geo-aware load balancer, I'm not sure if that IP is static, or if I'd get a different result if I called nslookup from a different region.

So, my question is: Are northbound IPs static, and if not, is there a way to get a list?

Thanks!

[DChiesa · Accepted solution]

No, the IP addresses are not guaranteed to be static.

They are semi-stable. In practice the IP addresses don't change very often, usually. Sometimes months go by with no change. But sometimes the addresses change, and they change without notice. Sometimes they change twice in one day. The change is not always directly under the control of Apigee. For a recent example of how this might happen, consider the Spectre bug - servers in the cloud were rebooted with very little warning, and in some cases the Apigee routers got new IP addresses.

Obviously, we use DNS for the name-to-IP address mapping. You can use nslookup or dig to find the addresses.

If clients are concerned about authenticating the endpoints, I advise you to use TLS. You can register your own server-side cert and name, and have the client verify THAT.

I know there are may shops that continue to depend on IP whitelists to restrict outbound requests. If that is the current practice at your shop, then I suggest this approach: have the security/firewall people configure a cron job to run a dig query continuously, and then auto-reconfigure the outbound firewalls in the case that a new IP address is listed, or a previously known IP address disappears.

Now that I think about it, it would be smart for you to build a micro-service that would do the querying of DNS, and the management of the "fresh list" of IP addresses. and then just have your cron job periodically send a request to the micro-service, and configure or reconfigure the firewall accordingly.

To answer your last question, "is it possible to get a list?"

Yes, it is possible if you have a commercial license for Apigee Edge. Log a support ticket and request that information. But keep in mind it may change!