Firewall Settings for Scalefusion

Scalefusion is a cloud-hosted solution with servers across the continents. This means devices enrolled and managed by Scalefusion need to have continuous access to Scalefusion's servers so that they can be managed in real-time. The devices also need to have a connection with Google Push services, Apple Push services and Windows Push services, along with other components that are required for the management of devices. Also, to access Scalefusion's Dashboard, the PC/Laptop needs to have access to certain IPs and URLs.

However, an organization might be restricting internet access on their corporate-managed devices and/or PCs/Laptops by using a firewall or a proxy. In such cases, it becomes important to allow the URLs, IPs and ports required for Scalefusion to work smoothly in your organization.

This guide outlines the Firewall settings that need to be done for Scalefusion.

All Regions

The following URLs, IP addresses and FQDNs need to be allowed in the firewall: 

General

Android

Android GCM/FCM Push

1. Google GCM/FCM IP Addresses: All IP addresses contained in the IP blocks listed in Google's ASN of 15169
   1. Description: If your organization has a firewall that restricts the traffic to or from the Internet, you'll need to configure it to allow connectivity with GCM. GCM doesn't provide specific IPs. It changes IPs frequently. So all the IPs listed here, https://www.dan.me.uk/bgplookup?asn=15169, should be allowed.
2. Google GCM Domain: mtalk.google.com:5228 & android.googleapis.com:443 & android.clients.google.com:443
   1. Description: Some older Android versions need the above domain: port to be allowed for the GCM/FCM push to work.

For additional details and URL, please refer to FCM Firewall Rules and Firewall rules for Android Enterprise, aka EMM, to work properly.

iOS and macOS

Apple Push Notifications: Please refer to Apple’s documentation on the firewall configuration for Apple Push Notifications to work, at https://support.apple.com/en-in/HT203609

Windows

If you are using Scalefusion to manage Windows device inventory, then please allow the below URLs: 

If the above is not feasible, you need to use the IP list Microsoft provides and update it about every 2- 3 weeks, http://www.microsoft.com/en-us/download/confirmation.aspx?id=44238

Courtesy: StackOverflow

Pushy

On Devices that do not support Google Play Services, Scalefusion uses Pushy for sending remote commands. To allow Pushy to work, please use: 

Note: Please notice the * character, which indicates a wildcard subdomain allowed, and the two separate domains pushy.me and pushy.io.

Remote Cast & Control

If you use Scalefusion’s Remote Cast & Control, please allow the WebRTC connections below: 

OneIdP

If you are using Scalefusion's OneIdp suite of services, then please allow the below URLs: 

Global Instance

If you are using Scalefusion’s OneIdP on https://app.scalefusion.com, then please allow the following URLs:

US Instance

If you are using Scalefusion’s OneIdP on https://endpointlockdown.com, then please allow the following URLs:

India Instance

If you are using Scalefusion’s OneIdP on https://in.scalefusion.com, then please allow the following URLs:

Global (EU) Instance

This section provides the URLs and FQDNs that you have to allow if you are using https://app.scalefusion.com

US Instance

This section provides the URLs and FQDNs that you have to allow if you are using https://endpointlockdown.com

India Instance

This section provides the URLs and FQDNs that you have to allow if you are using https://in.scalefusion.com

Transport Layer Security (TLS) versions

Scalefusion supports only TLSv1.2 and TLSv1.3 versions, so please allow traffic on/from this layer.