How To: Whitelist SecureAuth's Kafka Endpoint for Automatic Connector Log Delivery

Version Affected: All Cloud IdPs

 

Overview

The Connector stores its logs locally, but can also automatically forward them to SecureAuth over the network for troubleshooting purposes. If a firewall blocks this outbound traffic, the logs never reach SecureAuth. This article explains what to allow through the firewall so the Connector's automatic log delivery can reach SecureAuth.

The Connector sends its logs to the following address:

pkc-4nym6.us-east-1.aws.confluent.cloud, port 9092

This address can resolve to any of the AWS US-East-1 public IP addresses, and the specific IP it resolves to can change over time.

Whitelisting the Kafka Endpoint

1. If your firewall can whitelist by DNS name, allow outbound traffic to pkc-4nym6.us-east-1.aws.confluent.cloud on port 9092. This is sufficient on its own.
2. If your firewall can only whitelist by IP address, retrieve the current list of AWS public IP ranges from https://ip-ranges.amazonaws.com/ip-ranges.json and whitelist the ranges for the us-east-1 region on port 9092. To filter that list down to just the us-east-1 region using PowerShell:
   
   

   (Invoke-RestMethod -Uri "https://ip-ranges.amazonaws.com/ip-ranges.json").prefixes |
       Where-Object { $_.region -eq "us-east-1" } |
       Select-Object -ExpandProperty ip_prefix |
       Sort-Object -Unique

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.