To communicate with your storage, Air Gap Protect requires that certain endpoints (URLs) be opened.
Considerations
-
Replace [region] with the region the MediaAgent is in.
-
For Azure Blob Storage, after the storage account is created, replace
*in*.blob.core.windows.netwith the name of the storage account. -
If your environment restricts outbound traffic by IP allowlists, verify the published cloud IP ranges for your provider:
-
Azure global and Azure Government regions: Azure IP Ranges and Service Tags – Public Cloud (allow the
Storageservice tag for Azure Storage, including Blob Storage) -
Google Cloud: Google Cloud IP Ranges
-
Oracle Cloud Infrastructure (OCI): OCI IP Address Ranges
-
Air Gap Protect in Amazon S3
| Source | Destination | TCP/UDP | Port |
|---|---|---|---|
| Customer workload network | s3.[region].amazonaws.com | TCP | 443 |
| Customer workload network | s3.us-gov-east-1.amazonaws.com | TCP | 443 |
| Customer workload network | s3.us-gov-west-1.amazonaws.com | TCP | 443 |
Air Gap Protect in Azure Blob Storage
Azure global regions
| Source | Destination | TCP/UDP | Port |
|---|---|---|---|
| Customer workload network | *.blob.core.windows.net | TCP | 443 |
| Customer workload network | https://login.microsoftonline.com | TCP | 443 |
Azure Government regions
| Source | Destination | TCP/UDP | Port |
|---|---|---|---|
| Customer workload network | *.blob.core.usgovcloudapi.net | TCP | 443 |
| Customer workload network | https://login.microsoftonline.us | TCP | 443 |
Air Gap Protect in Google Cloud Storage
| Source | Destination | TCP/UDP | Port |
|---|---|---|---|
| Customer workload network | storage.googleapis.com | TCP | 443 |
Air Gap Protect in OCI Object Storage
| Source | Destination | TCP/UDP | Port |
|---|---|---|---|
| Customer workload network | objectstorage.[region].oraclecloud.com | TCP | 443 |
| Customer workload network | identity.[region].oraclecloud.com | TCP | 443 |
Air Gap Protect in Amazon S3
| Source | Destination | TCP/UDP | Port |
|---|---|---|---|
| Control plane | https://login.microsoftonline.com | TCP | 443 |
| Control plane | https://api.mcss.metallic.io (IP address: 40.75.17.108) | TCP | 443 |
| Control plane | https://metallic.io | TCP | 443 |
| Control plane | https://www.commvault.com | TCP | 443 |
| Customer workload network | s3.[region].amazonaws.com | TCP | 443 |
| Customer workload network | s3.us-gov-east-1.amazonaws.com | TCP | 443 |
| Customer workload network | s3.us-gov-west-1.amazonaws.com | TCP | 443 |
Air Gap Protect in Azure Blob Storage
Azure global regions
| Source | Destination | TCP/UDP | Port |
|---|---|---|---|
| Control plane | https://login.microsoftonline.com | TCP | 443 |
| Control plane | https://api.mcss.metallic.io (IP address: 40.75.17.108) | TCP | 443 |
| Control plane | https://metallic.io | TCP | 443 |
| Control plane | https://www.commvault.com | TCP | 443 |
| Customer workload network | *.blob.core.windows.net | TCP | 443 |
| Customer workload network | https://login.microsoftonline.com | TCP | 443 |
Azure Government regions
| Source | Destination | TCP/UDP | Port |
|---|---|---|---|
| Control plane | https://login.microsoftonline.com | TCP | 443 |
| Control plane | https://api.mcss.metallic.io (IP address: 40.75.17.108) | TCP | 443 |
| Control plane | https://metallic.io | TCP | 443 |
| Control plane | https://www.commvault.com | TCP | 443 |
| Customer workload network | *.blob.core.usgovcloudapi.net | TCP | 443 |
| Customer workload network | https://login.microsoftonline.us | TCP | 443 |
Air Gap Protect in Google Cloud Storage
| Source | Destination | TCP/UDP | Port |
|---|---|---|---|
| Control plane | https://login.microsoftonline.com | TCP | 443 |
| Control plane | https://api.mcss.metallic.io (IP address: 40.75.17.108) | TCP | 443 |
| Control plane | https://metallic.io | TCP | 443 |
| Control plane | https://www.commvault.com | TCP | 443 |
| Customer workload network | storage.googleapis.com | TCP | 443 |
Air Gap Protect in OCI Object Storage
| Source | Destination | TCP/UDP | Port |
|---|---|---|---|
| Control plane | https://login.microsoftonline.com | TCP | 443 |
| Control plane | https://api.mcss.metallic.io (IP address: 40.75.17.108) | TCP | 443 |
| Control plane | https://metallic.io | TCP | 443 |
| Control plane | https://www.commvault.com | TCP | 443 |
| Customer workload network | objectstorage.[region].oraclecloud.com | TCP | 443 |
| Customer workload network | identity.[region].oraclecloud.com | TCP | 443 |