Page locked

This page is currently locked for editing by another user. You have to wait until this user finishes editing or the lock expires.
Currently locked by: 216.73.216.122
Lock expires at: 2025/10/09 09:21 (11 min)
This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
==== Firewall Settings ====


APEX communicates using SSL port 443 (https) and some communications take place using port 80 (http). The following table contains a list of hosts that must be reachable in order for APEX to be installed or be used after the installation:


{{tablelayout?colwidth="335px,125px,300px"&rowsFixed=1&rowsVisible=15&float=center}}
^ Host ^ IP Address ^ Description ^
| dev-ws02.certna.org | 204.246.133.236 | APEX installation host. |
| apex-setup.certna.org | 204.246.133.236 | APEX installation host. |
| apex-prd.certna.org | 204.246.133.237 | APEX production ERDS application servers. |
| apex-prd.certnag2g.org | 209.170.199.196 | APEX production G2G application servers. |
| reports.certna.org | 204.246.133.238 | APEX production ERDS report servers. |
| reports.certnag2g.org | 209.170.199.202 | APEX production G2G report servers. |
| CeRTNA-APEX-g6bygtdgh0aqh0fh.z01.azurefd.us | * (Note 1) | APEX Cloud WAF |
| *.digicert.com | * | DigiCert PKI certificate services. (Note 2) |
| *.ssl.com | * | SSL Code Signing certificate services. (Note 2) |
| *.godaddy.com | * | SSL certificate services. (Note 2) |


CeRTNA no longer interfaces with Entrust, therefore, the references to *.entrust.com and *.entrust.net shown above have been stricken out.

**Note 1:** CeRTNA recognizes that different firewalls are in service at our customers and that firewall features functions can vary broadly. CeRTNA prefers to minimize the amount of IT administrative support required by creating rules based on the following tolerance and/or capabilities of your firewall:

  - Use wildcard domains if possible. (Ex: *.certna.org or *.certnag2g.org)
  - Use host names if possible. (Ex: apex-prd.certna.org or reports.certna.org)
  - Last resort, use IP addresses. (Static IPs will be retired on Auguust 2,2025.)
    - The IP of our cloud WAF is not Static. A list of possible ranges is below. 

The preceding list is sorted in order of preference.


**Note 2:** Several digital certificates are used in support of CeRTNA/APEX, these include SSL certificates, PKI certificates for digital signatures, PKI certificates for encryption/decryption, and code-signing certificates. The CeRTNA APEX application uses core WCF & .NET functionality to verify that the PKI certifcates are still valid and have not expired. Further, during the APEX installation/update process, the code-signing certificate is validated. The lower level WCF & .NET API's communicate using port 80 for OCSP and CRL certificate validation functions. It is important that your firewall team take this into consideration.

In addition to the locations listed above, there are some additional hosts that you also want to allow in order to facilitate the retrieval of Windows Updates and for CeRTNA remote support.

{{tablelayout?colwidth="175px,125px,300px"&rowsFixed=1&rowsVisible=10&float=center}}
^ Host ^ IP Address ^ Description ^
| *.microsoft.com | * | Top-level Microsoft domain, to avoid issues with Windows functionality. (Note 3)|
| *.update.microsoft.com | * | General Windows update domain. |

Configuring the firewall rules for Windows Updates and other fundamental OS support, for example, virus definition files for Endpoint Protection or other 3rd party system management tools is the responsibility of your organizations IT staff. The information provided in the preceding table is here simply point out that there are additional URL's that may need to be accommodated beyond those that are required for APEX and/or CeRTNA functionality.


**Note 3:** Support for Teams meetings and screensharing is also required for remote support of the APEX software and client installation. 

==== Cloud WAF IP Ranges ====
    * 20.140.48.68/30
    * 20.140.56.68/30
    * 20.140.64.68/30
    * 20.140.72.68/30
    * 20.140.77.113/32
    * 20.140.147.200/29
    * 20.140.151.73/32
    * 20.140.151.74/31
    * 20.140.152.48/30
    * 20.141.10.208/29
    * 20.141.12.33/32
    * 20.141.12.34/31
    * 20.141.16.158/32
    * 20.141.18.104/29
    * 20.141.19.32/29
    * 20.159.108.84/30
    * 52.127.49.64/30
    * 52.181.33.42/32
    * 52.181.33.44/32
    * 52.181.33.46/32
    * 52.181.33.48/32
    * 52.181.33.50/32
    * 52.181.33.52/32
    * 52.181.33.54/32
    * 52.181.33.56/32
    * 52.182.32.230/32
    * 52.182.33.4/32
    * 52.182.33.6/32
    * 52.182.33.8/32
    * 52.182.33.10/32
    * 52.182.33.12/32
    * 52.182.33.14/32
    * 52.182.33.48/32
    * 52.227.226.250/32
    * 52.227.227.12/32
    * 52.227.227.23/32
    * 52.227.227.25/32
    * 52.227.227.29/32
    * 52.227.227.31/32
    * 52.227.227.33/32
    * 52.227.227.35/32
    * 52.235.253.120/29
    * 52.243.152.68/32
    * 52.243.155.57/32
    * 52.243.156.34/32
    * 52.243.156.157/32
    * 52.243.156.164/32
    * 52.243.156.166/32
    * 52.243.156.209/32
    * 52.243.156.212/32
    * 52.244.34.47/32
    * 52.244.34.118/32
    * 52.244.34.125/32
    * 52.244.34.127/32
    * 52.244.34.129/32
    * 52.244.34.131/32
    * 52.244.34.133/32
    * 52.244.34.135/32
    * 52.244.239.112/30
    * 52.245.153.184/29
    * 2001:489a:3103::5a0/123
    * 2001:489a:3103::7c0/123
    * 2001:489a:3203::5e0/123
    * 2001:489a:3303::5a0/123
    * 2001:489a:3303::7c0/123
    * 2001:489a:3403::5e0/123
    * 2001:489a:3604::5a0/123
    * 2001:489a:3604::7c0/123