Required outbound connections for Air Gap Protect storage

To communicate with your storage, Air Gap Protect requires that certain endpoints (URLs) be opened.

Considerations

Replace [region] with the region the MediaAgent is in.
For Azure Blob Storage, after the storage account is created, replace * in *.blob.core.windows.net with the name of the storage account.
If your environment restricts outbound traffic by IP allowlists, verify the published cloud IP ranges for your provider:
- Azure global and Azure Government regions: Azure IP Ranges and Service Tags – Public Cloud (allow the Storage service tag for Azure Storage, including Blob Storage)
- Google Cloud: Google Cloud IP Ranges
- Oracle Cloud Infrastructure (OCI): OCI IP Address Ranges

Commvault SaaS

Source	Destination	TCP/UDP	Port
Customer workload network	s3.[region].amazonaws.com	TCP	443
Customer workload network	s3.us-gov-east-1.amazonaws.com	TCP	443
Customer workload network	s3.us-gov-west-1.amazonaws.com	TCP	443

Source	Destination	TCP/UDP	Port
Customer workload network	*.blob.core.windows.net	TCP	443
Customer workload network	https://login.microsoftonline.com	TCP	443

Source	Destination	TCP/UDP	Port
Customer workload network	*.blob.core.usgovcloudapi.net	TCP	443
Customer workload network	https://login.microsoftonline.us	TCP	443

Source	Destination	TCP/UDP	Port
Customer workload network	storage.googleapis.com	TCP	443

Source	Destination	TCP/UDP	Port
Customer workload network	objectstorage.[region].oraclecloud.com	TCP	443
Customer workload network	identity.[region].oraclecloud.com	TCP	443

Commvault software

Source	Destination	TCP/UDP	Port
Control plane	https://login.microsoftonline.com	TCP	443
Control plane	https://api.mcss.metallic.io (IP address: 40.75.17.108)	TCP	443
Control plane	https://metallic.io	TCP	443
Control plane	https://www.commvault.com	TCP	443
Customer workload network	s3.[region].amazonaws.com	TCP	443
Customer workload network	s3.us-gov-east-1.amazonaws.com	TCP	443
Customer workload network	s3.us-gov-west-1.amazonaws.com	TCP	443

Source	Destination	TCP/UDP	Port
Control plane	https://login.microsoftonline.com	TCP	443
Control plane	https://api.mcss.metallic.io (IP address: 40.75.17.108)	TCP	443
Control plane	https://metallic.io	TCP	443
Control plane	https://www.commvault.com	TCP	443
Customer workload network	*.blob.core.windows.net	TCP	443
Customer workload network	https://login.microsoftonline.com	TCP	443

Source	Destination	TCP/UDP	Port
Control plane	https://login.microsoftonline.com	TCP	443
Control plane	https://api.mcss.metallic.io (IP address: 40.75.17.108)	TCP	443
Control plane	https://metallic.io	TCP	443
Control plane	https://www.commvault.com	TCP	443
Customer workload network	*.blob.core.usgovcloudapi.net	TCP	443
Customer workload network	https://login.microsoftonline.us	TCP	443

Source	Destination	TCP/UDP	Port
Control plane	https://login.microsoftonline.com	TCP	443
Control plane	https://api.mcss.metallic.io (IP address: 40.75.17.108)	TCP	443
Control plane	https://metallic.io	TCP	443
Control plane	https://www.commvault.com	TCP	443
Customer workload network	storage.googleapis.com	TCP	443

Source	Destination	TCP/UDP	Port
Control plane	https://login.microsoftonline.com	TCP	443
Control plane	https://api.mcss.metallic.io (IP address: 40.75.17.108)	TCP	443
Control plane	https://metallic.io	TCP	443
Control plane	https://www.commvault.com	TCP	443
Customer workload network	objectstorage.[region].oraclecloud.com	TCP	443
Customer workload network	identity.[region].oraclecloud.com	TCP	443