Firewall Review Checklist - Post Hosting Model/Server Change
Last Modified on 11/07/2024 11:24 am CST
When your Campus site is being moved to a new server or hosting model, your district needs to review all relevant firewalls, web filters, and network devices to ensure that the allow list is up-to-date. To prevent service interruptions, make necessary changes during the scheduled IP change while your Campus site is offline.
Infinite Campus IP addresses are listed in the Support Portal and can be accessed by Authorized Support Contacts in your district. If you are an Authorized Support Contact, you can find the IP information by going to https://support.infinitecampus.com/customers/s/hosting-documentation, selecting the Network and Firewall Guidance document, and noting the entire Infinite Campus IP Information section, which includes IP Ranges, Customer SIS IPs, and DC Overload IPs.
Review not only your district's internal network but any third-party servers that your district has configured your Campus site to communicate with. Follow up with the administrators of those servers as well. The following tools interface with other systems and may be affected if your Campus app server IP address ranges are not included in the allow list:
Data Extract Utility
When your district sets up a Data Extract Utility connection, it specifies which third-party server that extract should be sent via the Server field. Now that your Campus IP address has changed, you may need to ensure this value is not an internal IP address. If you experience issues after the IP change, you may also need to re-provide whoever manages that server's Campus IP ranges for allow-listing.
Does My District Use It?
Change Needed
Click here to expand...
To check if your district uses the Data Extract Utility or Data Extract Zip Tool:
Navigate to System Settings > Data Utilities > Data Extract Utility (and or Data Extract Zip Tool)
Look to see if any extracts have been set up. If yes, your district uses the Data Extract Utility, and you should review your server IP values.
Click here to expand...
Update the Server Value
This value can be either a hostname or an IP address. For any IP addresses listed, look for internal IP addresses.
For example, if it starts with "10." that indicates an internal IP address. If your Campus site is no longer hosted within the same network as the server listed in this field, using an internal IP address will not work; coordinate with your network team to determine the equivalent external IP address for that server and use that instead.
Review Your Extract Destination Server
If your district encounters any issues with Data Extract Utility extracts immediately after your IP address change, please contact the individual managing the server to which the extract is being sent and ensure they have updated the allow-listed Infinite Campus IP ranges.
The IP addresses for Infinite Campus are listed in the Support Portal and can be accessed by your district's Authorized Support Contacts. If you are an Authorized Support Contact, please go to https://support.infinitecampus.com/customers/s/hosting-documentation, choose the Network and Firewall Guidance document, and make a note of the entire section on Infinite Campus IP Information, including the IP Ranges, Customer SIS IPs, and DC Overload IPs.
Provide these IP ranges to the server administrator to allow list the Infinite Campus IP ranges.
Data Import
The Technical Services team may configure the Data Import tool for your district if your district contracts with Technical Services to establish a custom import. Now that your Campus IP address has changed, you may need to ensure your Data Import configuration does not point to an internal IP address. If you experience issues after the IP change, you may also need to re-provide whoever manages that server's Campus IP ranges for allow-listing.
Does My District Use It?
Change Needed
Click here to expand...
Perform a Tool search for Data Import. If you do not see Data Import among the results, your district does not use the Data Import tool.
If you have the tool, review the Server field. If the value is xxxxxx.infinitecampus.org and your Campus site is hosted within the Infinite Campus network, no action is needed.
Click here to expand...
Update the Server Value
This value can be either a hostname or an IP address. For any IP addresses listed, look for internal IP addresses.
For example, if it starts with "10." that indicates an internal IP address. If your Campus site is no longer hosted within the same network as the server listed in this field, using an internal IP address will not work; coordinate with your network team to determine the equivalent external IP address for that server and use that instead.
Review Your Import Server
If your district experiences any issues with data import after changing your IP, please contact the person who manages the server from which the data is being imported. Make sure that they have allowed the latest Infinite Campus IP ranges. The IP addresses for Infinite Campus are documented in the Support Portal and can be accessed by the Authorized Support Contacts in your district.
If you are an Authorized Support Contact, go to https://support.infinitecampus.com/customers/s/hosting-documentation, select the Network and Firewall Guidance document, and note the entire Infinite Campus IP Information section, including IP Ranges, Customer SIS IPs, and DC Overload IPs.
Provide these IP ranges to the person administering the server(s) in question so they can ensure their server allows traffic from the Infinite Campus IP ranges.
FRAM Scheduled Imports
When your district sets up a scheduled import, it specifies what 3rd party server that extract should be sent to via the Host field. Now that your Campus IP address has changed, you may need to ensure this value is not an internal IP address. If you experience issues after the IP change, you may also need to re-provide whoever manages that server's Campus IP ranges for allow-listing.
Does My District Use It?
Change Needed
Click here to expand...
Navigate to FRAM > Tools >Scheduled Imports. If imports are set up within the Data Import Editor, your district uses this tool, and server values must be reviewed.
Click here to expand...
Update the Host Value
This value can be either a hostname or an IP address. For any IP addresses listed, look for internal IP addresses.
For example, if it starts with "10." that indicates an internal IP address. If your Campus site is no longer hosted within the same network as the server listed in this field, using an internal IP address will not work; coordinate with your network team to determine the equivalent external IP address for that server and use that instead.
Review Your Import Server
If your district encounters any issues with your data import following your IP address change, please contact the individual responsible for managing the server from which the data is being imported. Make sure that they have allowed the most current Infinite Campus IP ranges. The IP addresses for Infinite Campus are listed in the Support Portal and can be accessed by the Authorized Support Contacts for your district.
If you are an Authorized Support Contact, please go to https://support.infinitecampus.com/customers/s/hosting-documentation, select the Network and Firewall Guidance document, and note the entire Infinite Campus IP Information section, including IP Ranges, Customer SIS IPs, and DC Overload IPs.
Provide these IP ranges to the person administering the server(s) in question so they can ensure their server is allow-listing the Infinite Campus IP ranges.
LDAP Server
When your district first set up an LDAP connection to your Infinite Campus site, they entered the IP address or hostname of your district's LDAP server(s) into the Server Host field(s). Now that your Campus IP address has changed, you may need to ensure this value is not an internal IP address.
The person managing your district's LDAP server likely had to allow-list Infinite Campus' IP ranges so that your district's LDAP server wouldn't block your Infinite Campus site's attempts to communicate with it. You may also need to provide the person managing your district's LDAP server with the Campus IP ranges for allow-listing.
Does My District Use It?
Change Needed
Click here to expand...
Navigate to User Management > Settings > LDAP Configuration.
You must review server values if your district has an LDAP connection here and the 'Enable this LDAP Configuration' checkbox is marked for an existing LDAP configuration.
Click here to expand...
Update Server Host Field(s)
If your Campus site is no longer hosted within the same network as the server listed in this field, be sure these values are not internal IP addresses.
For example, if it starts with "10." that indicates an internal IP; work with your network team to determine the equivalent external IP address for that service and use that instead.
Review Your LDAP Server
You may also need to provide the campus IP ranges to the manager of your district's LDAP server for allow-listing. The IP addresses for Infinite Campus are available in the Support Portal and can be accessed by your district's Authorized Support Contacts.
If you are an Authorized Support Contact, please go to https://support.infinitecampus.com/customers/s/hosting-documentation, select the Network and Firewall Guidance document, and note the entire Infinite Campus IP Information section, including the IP Ranges, Customer SIS IPs, and DC Overload IPs.
Provide these IP ranges to the person administering your district's LDAP server so they can ensure it is allow-listing the Infinite Campus IP ranges.
SIF
When your district sets up a SIF Agent, it enters an IP address value and a "URL of the zone to push to" value. Now that your Campus IP address has changed, you may need to ensure the IP address is not an internal IP address and that the "URL of zone to push to" uses https instead of http.
Does My District Use It?
Change Needed
Click here to expand...
Navigate to System Settings > Data Interchange Setup >Agent Setup.
Select each existing agent and note any values in the IP Address and the URL of the . If either refer to an internal IP (stats with a 10), it will likely need updating.
Click here to expand...
Update the IP Address Value
If your Campus site is no longer hosted within the same network as the server listed in this field, be sure this value is not an internal IP address.
For example, if it starts with "10." that indicates an internal IP; work with your network team to determine the equivalent external IP address for that service and use that instead.
Update the 'URL of zone to push to' Value
If your Campus site is no longer hosted within the same network as the service listed in this field, ensure that the URL starts with https:// instead of http://. If you are still experiencing issues, collaborate with the network team supporting that service to ensure it supports HTTPS.
Review Your SIF Agent Server
If you encounter any issues after the IP address change and have ruled out the above possibilities, also ensure that these services have allowed the most up-to-date IP ranges for Infinite Campus. The IP addresses for Infinite Campus are listed in the Support Portal and can be accessed by your district's Authorized Support Contacts.
If you are an Authorized Support Contact, please go to https://support.infinitecampus.com/customers/s/hosting-documentation, select the Network and Firewall Guidance document, and note the entire Infinite Campus IP Information section, including IP Ranges, Customer SIS IPs, and DC Overload IPs.
Provide these IP ranges to the person administering the server(s) in question so they can ensure their server is allow-listing the Infinite Campus IP ranges.
Other District Servers or 3rd Party Services
Review all district servers and/or 3rd party services you've configured to point to your Infinite Campus site and ensure Campus IP addresses are allow-listed.
