How to Configure the Corporate Firewall to Get the Solution Running¶
For users of the Email Sidebar on:
4 min read
To handle customers’ data enclosed in a secured corporate environment, RG Email Sidebar’s components RGES Add-In / Chrome Extension and RGES Sync Engine require two sets of allow-list rules to be configured by the local mail server and Salesforce Admins:
1. RGES infrastructure IPs allow-listed to access the corporate mail server and Salesforce
2. Firewall exceptions configured for end users’ work devices. All listed Revenue Grid and third-party resources are guaranteed to be secure, according to Revenue Grid privacy and security policies; all transferred data is encrypted with TLS 1.2
All RG Email Sidebar traffic is intended to go directly, not through a proxy connection.
Why do the IPs get changed in some updates?
- RGES server-side performance boosting (with up-to-date server equipment)
- Possible server-side disaster recovery scenarios improvement, by reducing users impact and functions recovery time (using the extra backup servers)
- Some of the reserved addresses are in resting state, they will be used in case of main servers downing, ensuring minimum users impact; they will be left unchanged in case of future server-side migrations
November 2021 Revenue Grid Resources’ IP Update¶
In November 2021 Revenue Grid Azure resources’ IPs got updated, ensuring: A. extra stability considering geographic proximity; B. even more security; C. allow-list config facilitation. During November 2021, all customers must add the four new ranges to their allow-lists and remove the old RGES IPs from the allow-lists.
Starting with December 2021, to access customers’ corporate mail servers and Salesforce Revenue Grid Sync Engine and Add-In / Chrome Extension will be using only four designated IP ranges in different geographic locations: US Central and US East, Europe West and Europe North; four main use and four standby IPs are allocated within every range.
RGES Chrome Extension for Google requires the same set of IPs, plus Chrome Web Store resource allow-listing is required.
1. RGES Resources Allow-Listed to Access the Mail Server and Salesforce¶
Tip
A mask - an IP ending with /28, /29, /30, /31, etc. on the lists represents a hidden range of several secure affiliated IPs allocated with Classless Inter-Domain Routing (CIDR). For customers’ convenience, we’ve expanded ranges of the updated masks list
All these are Inbound connections; MS Exchange / O365 / Google and Salesforce servers getting accessed by Revenue Grid components. Protocol: 443 / HTTPS
Dedicated IPs added in November 2021:
20.112.208.0/29 mask
actual range 20.112.208.0 - 20.112.208.7
20.80.207.144/29 mask
actual range 20.80.207.144 - 20.80.207.151
20.103.185.48/29 mask
actual range 20.103.185.48 - 20.103.185.55
20.105.57.72/29 mask
actual range 20.105.57.72 - 20.105.57.79
For EU-only Customers¶
If you need a EU-only Data Locality and you have got a confirmation from Revenue Grid team that your RGES tenant is provisioned with enabled Data Locality feature, you may allow-list only the dedicated EU ranges:
20.103.185.48/29 mask
actual range 20.103.185.48 - 20.103.185.55
20.105.57.72/29 mask
actual range 20.105.57.72 - 20.105.57.79
Full Revenue Grid Package IPs¶
These IPs must be allow-listed in every organization that uses the full Revenue Grid package to enable its functioning. Also see this article for more information.
Sequenced outbound emails automation, Campaigns, Sales Engagement:
52.173.139.99
52.173.188.229
52.173.184.127
52.173.186.243
52.173.190.95
52.176.107.202
52.173.184.202
52.173.190.226
Revenue Grid Signals:
23.99.196.180
168.61.185.160
168.61.178.14
23.99.133.3
104.43.130.88
168.61.153.98
168.61.165.70
168.61.188.249
Indexer:
40.119.56.217
Auxiliary:
Org's Microsoft Exchange (OWA, ECP,EWS, etc.), if needed
login.salesforce.com and its dependencies
fonts.gstаtic.com
chrome.google.com for RGES Chrome Extension
Handling Salesforce Access Restrictions¶
In addition, in some Orgs Salesforce logging in and data access are restricted for a pre-set IP addresses range. If you cannot log in to Salesforce via RG Email Sidebar, make sure that the above listed IP addresses are included in Login / Trusted IP ranges of your Salesforce account or Org. Please find more info on how to manage them in this official Salesforce blog or their official documentation regarding Login IP ranges and Trusted IP ranges.
2. Work Devices’ Firewall Exceptions for RGES Add-In / Chrome Extension¶
Tip
Contact your firewall software vendor for guidance how to configure allow-list rules
All these are Outbound connections from end users’ work devices. Protocol: 443 / HTTPS
Main Revenue Grid Resources¶
*.revenuegrid.com
*.invisible.io
*.invisiblesolutions.com
*.smartcloudconnect.io
Auxiliary Resources¶
These are auxiliary CDN, API, Microsoft, Google, Cloudflare, Bootstrap, etc. resources used by the solution.
*.revenuegrid.commaxcdn.bootstrapcdn.com
appsforoffice.microsoft.com
fonts.googleapis.com
cdnjs.cloudflare.com
ajax.googleapis.com
az416426.vo.msecnd.net
Extra Resources for Troubleshooting¶
Add these additional resources to firewall exceptions if issues occur on opening RG Email Sidebar, Sync dashboard, Customization page, or RGES Admin panel. These are required Salesforce, Microsoft, wizards or guides rendering, and other relevant resources.
In addition, to be able to access Sync Engine settings make sure that your browser’s ad blocking plugins (e.g. AdBlock Plus or uBlock Origin) are disabled for RGES Sync dashboard web page.
*.smartcloudconnect.io
*.salesforce.com
dc.services.visualstudio.com
logo.clearbit.com
autocomplete.clearbit.com
api.genderize.io
api.ipify.org
static.userguiding.com
api.userguiding.com
ust.userguiding.com
We would love to hear from you!