MigrationWiz uses a global geo-distributed migration farm which includes thousands of IP addresses. In some cases, however, network administrators may want to restrict access to a pre-determined set of IP addresses for security reasons. As a result, we offer the ability to lock down a MigrationWiz connector to use only a specific set of IPs.
If an IP LockDown is required, we offer the option to bind a connector to one of our U.S. data centers, or a regional Azure Data Center. It is important to understand the impact on the migration:
- Migration data traffic will proceed through the Azure Data Center in the region selected for the migration, although some data will go through our U.S. Data Centers.
- There may be some competition for computing resources. When not using IP LockDown, BitTitan offers unlimited computing power and bandwidth.
Note: IP LockDown does not work with BitTitan Autodiscover for Users. To add Users to the project, use either Bulk Add via CSV file or add the Users manually.
There are two steps that need to be followed. These are detailed below:
Set Advanced Options for the project in MigrationWiz
Complete these steps to set the preferred data center and add the support option for IP LockDown:
- Sign in to MigrationWiz at http://migrationwiz.bittitan.com/
- Access the project dashboard.
- Click Edit, and then click Advanced Options.
- In the Performance section, select the customer's local region under the Preferred BitTitan Data Center drop-down menu.
- In the Support section, add this support option in the Support Options field:
Tags=IpLockDown! - Click Save.
Open firewall ports
- Open firewall ports to allow MigrationWiz to communicate back to BitTitan servers. All migrations need to have the following ports open.
- Ports:
80
443 - If migrating from Zimbra, ports 7070 and 7071 will also need to be open.
- Ports:
Add the below IP's and the IP's for your regions Datacenter listed below.
IPs:
50.251.230.13
66.195.187.146
40.65.119.127
40.65.127.67
101.100.176.129
50.203.126.142
52.151.0.32
52.156.70.193
52.191.137.80
13.66.255.144
- Find the data center that is closest to the customer, and open the firewall ports to allow access to the list of IP addresses in that data center (not all data centers have multiple IP addresses).
Data Center Location IP Address(es) Asia Pacific 35.185.183.142
40.65.182.102
104.215.190.182Australia 35.201.26.62
52.156.168.99
13.70.127.108Canada 34.95.35.151
52.228.25.105
40.85.200.120France 40.89.186.56 Germany (when using
bittitan.de)51.4.144.218
51.4.197.3Japan 13.71.154.248
13.78.13.205
34.84.119.7United States 13.77.146.155
137.117.56.87
51.143.100.12
51.143.92.223
51.143.95.41
51.143.96.41
51.143.98.138
51.143.99.45
52.158.235.245
52.226.78.35Northern Europe 35.228.93.143
40.127.98.111
52.164.186.162South Africa 102.133.171.22 South America 191.234.178.158
191.232.194.231Western Europe 13.80.30.40
35.240.74.130
40.114.227.156
Comments
6 comments
This documentation is difficult to understand. It does not include which TCP/UDP ports must be open, and the direction of the traffic is unclear.
These IP addresses have been changed 3 times in the last 30 days. Can we get some sort of conformation that these are correct? It's hard requesting firewall exclusions to keep having to refresh a document with no notification.
Hi Jonathan Mudgett,
I have verified that the list in this article is accurate. The IP addresses listed were in the previous lists as well, the recent updates to this list refined the IP lists to try to make it simpler to open the ports. Sorry for the confusion. The changes should be less frequent on this article, at least with regards to the IP addresses changing. That's the plan, for sure.
I fail to understand why I would need to open outbound communications from the Exchange server as implied in point 1, seeing as only EWS is used. Outbound communications would be used for agent-based software installed on the Exchange servers.
Also, when talking about opening firewall ports, you should specify the ports. In this case I believe it's TCP 443 (HTTPS) only.
So I agree with Tom Jones..
We do not install software on a customers Exchange server for migrations. We do utilize the EWS protocol for migrations which as you stated does require port 443 to be open in your firewall. This article is specifically about what IP addresses to open for communication. Some sytems use different ports for communication. If you have any further inquires please feel free to contact our sales or support team.
How do I get support for your products?
It seems that there are IPs's missing for MSPComplete Agent User Importing trough the Endpoint. As when i only whitelist the once mentioned. Migrations work but Endpoint Discovery does not work.
BitTitan Triage Would you be able to expand on this ?
Please sign in to leave a comment.