Not a customer? Click the 'Start a free trial' link to begin a 30-day SaaS trial of our product and to join our community.
Existing Cisco AppDynamics customers should click the 'Sign In' button to authenticate to access the community
on
09-22-2017
01:53 PM
- edited on
07-23-2021
04:53 PM
by
Claudia.Landiva
AppDynamics SaaS customers must make sure that their Agents can communicate to the AppDynamics SaaS Infrastructure (including the Controller, Analytics, and EUM) from the customer's network by allowing certain IP ranges.
In a SaaS environment, various Agents communicate to the SaaS Controller to publish metrics.
These Agents can be:
Agents need to connect to an AppDynamics Controller in order to retrieve configuration data and send information about the monitored environment. The connection between the Agent and the Controller is a one-way connection initiated by the Agent; the Controller will never initiate a connection out to the Agent. The Agent only needs to use SSL on TCP port 443 for its communication to the Controller.
AppDynamics IP Ranges
To enable Agents to communicate with a Controller, permit the IP range below:
Quick Reference: https://docs.appdynamics.com/display/PAA/SaaS+Domains+and+IP+Ranges
For more information about Agent communication, see the following sections App Agent Security and Machine Agent Security.
SaaS customers' Analytics Agent or on-premises Controller needs to communicate with SaaS Analytics Processor in order to publish application/log events.
For the analytics capabilities of the AppDynamics SaaS Platform, analytics.api.appdynamics.com
needs to be permitted. If a customer is not comfortable with permitting based on DNS names, then they should designate the full IP range for the AWS UsWest2 region.
See: https://ip-ranges.amazonaws.com/ip-ranges.json
EUM JavaScript Agents and Mobile Agents (iOS/Android/Xamarin) send beacons to EUM Cloud Collectors, so it's expected that the end-users network should allow communication to the EUM Cloud Collectors located at col.eum-appdynamics.com
.
Customers with an on-premises Controller will need to permit the EUM Cloud Aggregator, located at api.eum-appdynamics.com.
Both EUM CloudCollectors and Aggregator are hosted in AWS Region USWest2, same as Analytics.
If the customer can't permit IP addresses based on domain, they should permit the full IP range for AWS UsWest2 region.
What about ranges for other regions? I understand there are SaaS deployments in other other AWS locations.
I can't believe that you say if you can't use the DNS name analytics.api.appdynamics.com then basically open up to all of the US-West-2 IP addresses that AWS publish.
I'm sure you don't use all of them - other companies are in that region.
Not a very good security policy!
Thank you! Your submission has been received!
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form