¶ Which IP addresses do Exium services use?
There are two types of IP addresses that Exium services use: Egress and Ingress.
Egress IP addresses are the addresses that the Internet (any public destination) sees. This includes any website such as Google or SaaS service such as Office 365.
Ingress IP addresses are the addresses that Exium uses internally between Exium clients, cybergateways, and the cybermesh. So if a gateway or client is inside of a firewall, it is an Ingress IP that it will connect to through that firewall.
¶ Egress IP Addresses and Conditional Access
Many organizations use IP address allowlisting/whitelisting on their corporate cloud apps (such as Office 365) for additional security should a user’s credentials be compromised by a malicious actor. This allowlisting is typically inclusive of the egress IP addresses for customer data centers and remote offices. Typically for remote users, a VPN connection is required to access private applications and their corporate cloud applications.
With Exium, the traffic flow changes when utilizing the Exium client or the cybergateway. Because the Exium client and cybergateway encrypt their connections to the Exium cybermesh, cloud/ SaaS applications and IdP providers no longer see the corporate egress IP addresses and instead see the egress IP addresses for Exium’s cybermesh.
The preferred solution is to add Exium’s cybermesh IP addresses (provided in the Table below) to your IP address allowlisting for conditional access and employ multi-factor authentication (MFA) with your IdP provider.
Exium also offers Dedicated Egress IP Addresses which are static; contact your Exium rep to learn more about these.
See below for the list of Exium’s cybermesh shared IP addresses.
| Region | Your preferred Server (Cybernode) | Egress and Ingress Subnets |
|---|---|---|
| All | Any | 2605:e240::/32 (IPv6) |
| USA | New York, Los Angeles, Dallas | 64.29.176.0/21 |
| Chicago | 64.29.176.0/21, 38.83.113.0/25 | |
| Ashburn - Virginia, USA | 64.29.176.0/21, 172.111.38.0/24, 67.220.95.0/24 | |
| Atlanta | 64.29.176.0/21, 162.216.7.128/28 | |
| Denver | 64.29.176.0/21, 69.50.95.0/24 | |
| Phoenix | 64.29.176.0/21, 23.158.200.0/24 | |
| San Francisco | 64.29.176.0/21, 23.157.40.0/25 | |
| Seattle | 64.29.176.0/21, 91.191.218.32/28 | |
| Tampa | 64.29.176.0/21, 66.232.106.192/28, 209.133.195.192/28, 199.167.149.104/29 | |
| Canada | Montreal | 64.29.176.0/21, 23.162.56.0/25 |
| Toronto | 64.29.176.0/21, 190.102.106.224/28 | |
| Vancouver | 64.29.176.0/21, 158.51.123.0/24 | |
| Europe | Frankfurt | 64.29.176.0/21, 66.206.24.104/29 |
| London | 64.29.176.0/21, 68.168.31.128/25 | |
| Paris | 64.29.176.0/21, 45.128.134.208/29 | |
| Asia | Mumbai | 64.29.176.0/21 |
| Sydney | 64.29.176.0/21, 107.155.102.224/29 | |
| Singapore | 64.29.176.0/21, 107.155.95.24/29 | |
| Dubai | 64.29.176.0/21, 139.185.47.170 | |
| Africa | Johannesburg, South Africa | 64.29.176.0/21, 129.151.161.109, 129.151.180.150 |
Let us look at two examples:
- Your preferred server is New York, you only need to whitelist the subnet 64.29.176.0/21
- Your preferred server is Frankfurt, you need to whitelist the 66.206.24.104/29 subnet as well as the 64.29.176.0/21 subnet
Note that as long as you are whitelisting the egress IPs from the above table for your preferred server, conditional access should continue to work in case of failover.
¶ Ingress IP Addresses for Exium's Cybermesh
Exium Client and CyberGateway encrypts their connections to the Cybermesh. The encrypted traffic is sent to the Cybernode that the Client or CyberGateway is connected to. In cases, where the Client or Cyber Gateway traffic goes through an existing Firewall, you need to make sure that the outgoing ports shown in the Table below are open. If you have destination IPs block policy in your firewall, you need to make sure that you whitelist the “ingress” IP addresses for Exium’s Cybernodes. The ingress IPs are used from the same set as the egress IPs as provided earlier in the above table.
|
Protocol |
Clients (Allow Outgoing Ports) |
Cyber Gateways (Allow Outgoing Ports) |
Allow Incoming Ports |
|---|---|---|---|
| UDP | 51800-51850 | 3478-3479, 51800-51850 | None |
| TCP | None | 8089 | None |
¶ Configuring Conditional Access
You can configure conditional access in the centralized admin console by following the steps described in Traffic Steering in Exium's SASE Platform.
To learn more about implementing SASE for your organization and explore tailored solutions that meet your unique requirements, contact Exium at partners@exium.net for a consultation or demonstration. If you are ready to get started, check out our testing and onboarding process.