Company's Firewall configuration: what resources need to be opened in Firewall for the Nodegrid appliances to connect to ZPE Cloud?

Company's Firewall configuration: what resources need to be opened in Firewall for the Nodegrid appliances to connect to ZPE Cloud?

ZPE Cloud uses some IP addresses and hostnames that may be blocked by the Firewall rules.  This can prevent the Nodegrid appliances from connecting to the Cloud and/or utilizing specific ZPE Cloud features.  ZPE Cloud utilizes TCP port 443 for communication.

Important:
  1. After September 13, 2024, the new IPs will become active and the old IPs will become inactive.  See FAQ below for more details.
  2. Customers using ZPE Cloud on the European instance (zpecloud.eu) will also need to enable the IPs for the US server during enrollment. When enrolling a unit, it first connects to zpecloud.com and then is redirected to use the region specific servers.

US ZPE Cloud Servers:
Hostname(s)IP AddressUsage
second-tier-ca.zpecloud.com
device-api.zpecloud.com
device-apiv2.zpecloud.com
35.233.194.48 (old)
34.49.235.253 (new)
Required to sign the CSR to connect to Remote Access.
Required to Upload/Restore Backups.
Required to upload output from executed profiles.
api.astarte.zpecloud.com34.83.86.148 (old)
34.49.39.37 (new)
Required for Pairing API - without it, device is not able to authenticate against PubSub service and consequently connect to Cloud.
access.zpecloud.com35.230.32.156 (old)
34.49.235.61 (new)
Required for Remote Access - without it, device is not able to connect to Remote Access socket.
broker.astarte.zpecloud.com 34.83.67.57 (old)
34.49.26.197 (new)
Required for Broker connection - without it, device is not able to connect to PubSub service and consequently connect to Cloud.
proxy-access.zpecloud.com
api.zpecloud.com
34.83.37.8 (old)
34.120.236.72 (new)
Required for Enrollment.
Required to SSO from Cloud to Nodegrid appliance; also needs to be enabled on the Nodegrid appliance under Security :: Authentication :: SSO.


European ZPE Cloud Servers:
Hostname(s)IP AddressUsage
second-tier-ca.zpecloud.eu
device-api.zpecloud.eu
device-apiv2.zpecloud.eu
34.107.16.100 (old)
34.128.171.100 (new)
Required to sign the CSR to connect to Remote Access.
Required to Upload/Restore Backups.
Required to upload output from executed profiles.
api.astarte.zpecloud.eu34.107.15.10 (old)
34.49.228.213 (new)
Required for Pairing API - without it, device is not able to authenticate against PubSub service and consequently connect to Cloud.
access.zpecloud.eu34.107.6.32 (old)
34.128.152.77 (new)
Required for Remote Access - without it, device is not able to connect to Remote Access socket.
broker.astarte.zpecloud.eu 34.107.54.54 (old)
34.36.11.79 (new)
Required for Broker connection - without it, device is not able to connect to PubSub service and consequently connect to Cloud.
proxy-access.zpecloud.eu
api.zpecloud.eu
34.83.37.8 (old)
34.111.34.34 (new)
Required for Enrollment.
Required to SSO from Cloud to Nodegrid appliance; also needs to be enabled on the Nodegrid appliance under Security :: Authentication :: SSO.


Transition FAQ:

  • What will happen after September 13, 2024? Will the current IPs stop working? Is there any impact on the services?

    • After September 13, 2024, only the new IP addresses will be used for ZPE Cloud service. This change is automatic, and no action is needed on the Nodegrid device or ZPE Cloud side.

    • There will be no impact on services as long as firewalls are not blocking the new IP addresses.

  • Can I change my firewall whitelists now?

    • Yes, you can add the new IPs to your firewall whitelist now. Be sure to add the new IPs while keeping the existing ones in the firewall whitelist.

  • What business benefit does this offer to customers?

    • This change increases ZPE Cloud scalability and service availability, providing customers with a more reliable experience.

  • What happens if I don’t update my firewall whitelist?

    • If the whitelist is not updated, device access to ZPE Cloud will be blocked on September 13, 2024, until the new IP addresses are added.

  • If I don’t use firewall whitelists, do I need to take any action?

    • No action is required.

  • Are the new IPs currently active?

    • No, the new IPs will become active after September 13, 2024. However, it's advisable to add them to your whitelists in advance to ensure readiness for the transition.

  • Does this change require modification to Nodegrid configuration?

    • No, it does not require any modification to Nodegrid configuration.

Should you have any questions or concerns, please don't hesitate to reach out to our support team.


    • Related Articles

    • How to: Enable ZPE Cloud in a Nodegrid device

      ZPE Cloud is a powerful platform that allows you to manage your Nodegrid devices from anywhere in the world. In order to use the benefits of managing your Nodegrid devices through ZPE Cloud, you need to enroll the Nodegrid device to your company and ...

    • How to: Backup a Nodegrid device using ZPE Cloud

      ZPE cloud enables managing on-demand and scheduled backups of your Nodegrid devices. Login to ZPE Cloud Go to Devices :: Enrolled Select the devices you want to backup and then click Backup. You can backup multiples devices at once. Select the File ...

    • Firewall Rules for the Nodegrid Platform

      Version 0.2 (17 May 2018) Overview This guide lists all required and recommended firewall rules, to ensure a proper working of the solution. The list will need to be adjusted based on specific customer requirements. By default will the firewall will ...

    • How to: Add Devices to your ZPE Cloud company using Transfer Key

      ZPE Cloud is a powerful tool for managing your Nodegrid devices, and one of the methods to add a device to your company in ZPE Cloud is to use a unique 45-digit Transfer Key, which is a unique identifier assigned to a device or list of devices. ...

    • How to: Add Devices to your ZPE Cloud company using Customer Code and Enrollment key

      ZPE Cloud is a powerful tool for managing your Nodegrid devices, and one of the recommended methods to add devices to your company in ZPE Cloud is to use the Customer Code and Enrollment key. Customer Code is a unique 5-digit identifier assigned to ...