Whitelist Outbound Traffic

Allow outbound traffic using a wildcard domain to the Azure Relay Service (best practice). If the firewall does not allow wildcards, use the fully qualified domain names for your specific Azure Relay namespaces.

NOTE: For additional information, see Azure Relay WCF and Hybrid Connections DNS Support.

Allow Traffic using Wildcard Domain (Best Practice)

To allow traffic using a wildcard domain (Microsoft Recommended best practice), add *.servicebus.windows.net to the firewall rules permitting port 443 outbound.

Allow Traffic using IP addresses (Not Recommended)

To allow traffic using fully qualified domain names to the firewall rules:

  1. Look up the IP addresses used by the Azure Relay namespace. The IP addresses can be returned by using this script.

  2. Add the IP addresses to the firewall rules permitting port 443 outbound.

  3. Frequently monitor the IP addresses for changes. Update the IP addresses in the firewall rules when there are IP address changes. The IP addresses can be returned by using this script.

    NOTE: Up to 20% of the IP address can change in the span of a month. To ensure that Smart Integration Connector continues to operate, you will need to frequently monitor if these IPs change and adjust your firewall accordingly.