*This article is not an exhaustive list of possible impacts. For complete changes, please consult Salesforce official website.

Description

Salesforce is moving customer orgs to their new cloud-native infrastructure, Hyperforce. 
This knowledge article addresses possible impacts to connections between MuleSoft and Salesforce as a result of the org migration and suggests workarounds.

Target Audience

This document is for MuleSoft customers who have also Salesforce orgs which are being upgraded from first-party or non-Hyperforce public cloud infrastructure to Hyperforce. 
To locate your org, see Where is my Salesforce instance located? All Hyperforce upgrades are preceded by at least 90 days of advance notice

Hyperforce Changes

  Dynamic IP addresses

    Because of the dynamic nature of cloud environments, Salesforce recommends using mTLS as described in Preferred Alternatives to IP Allowlisting on Hyperforce, rather than IP allowlists.

    Impacted Services

• Dedicated Load Balancer Allowlists
• Cloudhub 1.0 VPC Firewall Rules
• Cloudhub 2.0 Private Space Firewall Rules
•  API Allowlist Policy 
  • Mule&Flex Gateway IP Allowlist Policy
  • Edge IP Allowlist Policy

Best Practices Recommended By Salesforce

      These security best practices are recommended by Salesforce and supported by MuleSoft

• Use Service Name Indicators
  • HTTP Connector | How to send a HTTP request to SNI enabled backend with Mule 4
  • Does Mule 3.9 support Server Name Indication (SNI)?
    * Inbound connection SNI is not supported. See How Does MuleSoft HTTP Connector Support Server Name Indication (SNI) for more details
• Implement Mutual TLS
  • How to prepare the client certificate file for DLB in dual authentication
  • Configure Client Certificate in TLS Context for HTTP Connector
• Use an Authentication Provider
  • JWT Validation Policy
  • OAuth 2.0 Token Policies (Mule Oauth Provider, OpenAM, OIDC, PingFederate)
• Streaming Services
  • Reviewing the Salesforce Org Migration Checklists,
    • Pre-org migration
      •  Pause publishing of events, and allow time for them to process. In Mule after the pause point, stop the Mule Application (this will disconnect the client from Salesforce)
      • Reset your clients storage to no longer retain and hold the last ReplayId. In Mule, this means clearing the ObjectStore specifically the StreamingObjectStore partition.
    • Post-org migration:
      • Reconnect your subscriber client and ensure it begins tracking and retaining the new ReplayIDs from this point forward. In Mule, this is done by starting the application again. As no replayID is persisted in the object store, the connector will subscribe and process all new events following the publish pause point.
  • Issues post Salesforce Migration please review the knowledge article: 
    • Salesforce Connector | Mule application fails to listen for platform events after salesforce org migration(hyperforce)
    • Salesforce connector replay channel Listener stops processing new events after backend salesforce instance migraged to hyperforce 

    IP Allowlists (Not Recommended)

      For customers who must use IP allowlists, IPs for connection from Salesforce to third-party networks such as the customer's network for Sales, Service, Industries, and Tableau Clouds are available in JSON format at the URL: https://ip-ranges.salesforce.com/ip-ranges.json. See Hyperforce IPs to Allow - Sales, Service, Industries, and Tableau Clouds. These addresses are not for email, and do not include IPs for Marketing Cloud, Commerce Cloud, Slack, or MuleSoft. For connections from the customer’s network to Salesforce, allowlist domains.

Salesforce References

• Preferred Alternatives to IP Allowlisting on Hyperforce
• Salesforce IP Addresses and Domains to Allow
• Hyperforce IPs to Allow - Sales, Service, Industries, and Tableau Clouds
• IP Addresses to Allow for Government Cloud Plus
• Retain uninterrupted access to Salesforce services on Hyperforce
• Resolve HTTPS/SSL connection errors in Hyperforce with SNI
• Salesforce Org Migration Checklists