IP addresses used by ArcGIS Online

[CrushedBauxite]

Similar to this submission, I am looking to find out the IP addresses used by ArcGIS Online. We are preparing to make use of a few services there but our network security team won't add a firewall rule for everyone to access our internal resources and instead want to restrict the source IPs to those used by ArcGIS Online.

I have contacted Esri support as suggested in the linked post above but was told that there is no static IP addresses and have been given a list of domains to be excepted. This isn't going to work for our firewall rules, of course.

Does anyone know what ranges are used here, or is this not possible?

[FC_Basson]

Here are results from an online IP lookup tool for the www.arcgis.com domain:

Source: whois.arin.net

IP Address: 23.21.110.28

Name: AMAZON-EC2-USEAST-10

Handle: NET-23-20-0-0-1

Registration Date: 9/19/11

Range: 23.20.0.0-23.23.255.255

Org: Amazon.com, Inc.

Org Handle: AMAZO-4

Address: Amazon Web Services, Inc.
P.O. Box 81226

City: Seattle

State/Province: WA

Postal Code: 98108-1226

Country: UNITED STATES

Name Servers: 

Source: whois.arin.net

IP Address: 54.197.254.10 (United States)

Name: AMAZO-ZIAD7

Handle: NET-54-196-0-0-1

Registration Date: 11/11/13

Range: 54.196.0.0-54.197.255.255

Org: Amazon.com, Inc.

Org Handle: AMAZO-4

Address: Amazon Web Services, Inc.
P.O. Box 81226

City: Seattle

State/Province: WA

Postal Code: 98108-1226

Country: UNITED STATES

Name Servers: 

Source: whois.arin.net

IP Address: 54.243.30.195 (United States)

Name: AMAZO-ZIAD1

Handle: NET-54-242-0-0-1

Registration Date: 11/9/12

Range: 54.242.0.0-54.243.255.255

Org: Amazon.com, Inc.

Org Handle: AMAZO-4

Address: Amazon Web Services, Inc.
P.O. Box 81226

City: Seattle

State/Province: WA

Postal Code: 98108-1226

Country: UNITED STATES

Then you'll need to find the IP ranges for the list of domain names that Esri provided you with?  Can you share those please?

[CrushedBauxite]

Thanks FC Basson. I had considered this but have had inaccurate results working this such ranges in the past. Also, despite it being a large range I still cannot be certain that I'm permitting (or denying) the correct ranges

Would it be necessary to allow all AWS IPs from a particular region? Would we need to allow ALL AWS IPs? Are there potentially other ranges outside of AWS that we would need to allow? For example Amazon's AWS IP Ranges page indicates at least 3 ranges for a single region

IpPrefix        Region       Service

23.20.0.0/14    us-east-1    AMAZON
50.16.0.0/15    us-east-1    AMAZON
50.19.0.0/16    us-east-1    AMAZON

The list of domains provided by support are:

https://ago-item-storage.s3.amazonaws.com

http://*.arcgis.com

https://*.arcgis.com

http://*.arcgisonline.com

https://*.arcgisonline.com

http://*.esri.com

https://*.esri.com

http://*.virtualearth.net 

[FC_Basson]

With the cloud based services it becomes difficult or impossible to pin down IPs, so adding the full range for each domain/sub-domain is probably the best option to ensure you have access to all the services. AWS might also even change the IP ranges according to this page: AWS IP Address Ranges - Amazon Web Services . But check with Esri and Amazon if you still have doubts about the security.

[CrushedBauxite]

Yeah, thanks FC Basson. Changing IP ranges is why I had hoped for some advice from Esri, but I understand that they may not know (or care) which IP ranges are in use when considering multiple availability zones, or even regions may change.

I'm proposing all AWS IPs at this stage so I'll see how things go.

Thanks

[RichardSnow]

It's a bit late, but on many firewalls the domain can be specified based on the list above... I was able to set that up for our use.

Just the FQDN from the list provided by support:

ago-item-storage.s3.amazonaws.com
arcgis.com
arcgisonline.com
esri.com
virtualearth.net

[KellyGerrow · Accepted solution]

Thanks Richard,

Here is a link to a maintained list of domains:

http://downloads.esri.com/resources/enterprisegis/AGOL_Domain_Requirements.pdf 

This article on trust.arcgis.com is a helpful link for implementation guidance questions:

ArcGIS Online Implementation Guidance—Trust ArcGIS | ArcGIS 

-Kelly

[ThomasColson]

I may be wrong on this, but it should be the same IP range that Windows Update uses, as WU, and many other "Updates" come from AmazonCloud. So if your IT blocks AGOL, they'll block Windows Update, which would be kind of hilarious as well as ironic. 

[CrushedBauxite]

Thanks Thomas. This is only in the context of ArcGIS services that are being exposed externally - this isn't a blanket ban on everything outside of AGOL/AWS. Similarly, MS do not publish Windows Update IP ranges but I would expect they would come from Azure, not AmazonCloud