Set Up AWS Direct Connect (DX) for Hyperforce

Connect to Hyperforce with AWS Direct Connect (DX)

First, choose between a hosted or dedicated connection. To use a hosted connection, work with an AWS DX delivery partner.

Select an AWS DX location in or near your Hyperforce region that is served by your connection provider. Work with the provider to create the AWS DX connection between your infrastructure and Hyperforce.

Recommendations

• To increase security of data in transit, use MacSEC encryption on the connection.
• To improve failover times, implement Bidirectional Forwarding Detection (BFD).
• To make sure that users access Hyperforce only through the DX connection, advertise your public IP address space only to DX, not the public internet. Then, add those IP prefixes to the trusted IP ranges for your organization.
• To restrict the DX connection to Hyperforce IPs, rather than all AWS Public IPs, allowlist the IPs mentioned in the section Manage Hyperforce IPs.
• To avoid conflicts in routing information from your DX connection and ISP connection, set the routing policies in your on-premises to prefer the DX connection.

These recommendations are covered in greater detail in the AWS/Salesforce joint blog, How to Access Salesforce Hyperforce Securely and Reliably with AWS Direct Connect.

Manage Hyperforce IPs

You may need to configure DX to manage three sets of Salesforce IPs: Hyperforce Public IPs, short-term AWS IPs for Salesforce Edge, and Email IPs used with Mail Transfer Agent (MTA). 

Allow Hyperforce Public IPs

DX users who choose to use allowlists must allow the complete set of Hyperforce public IP ranges, not just those for your country. The Hyperforce Public IPs are available for download in the JSON format at:

https://ip-ranges.salesforce.com/ip-ranges.json

Included Services

The JSON list includes IPs for inbound connections to Hyperforce from external sources, including some for Salesforce Edge, as well as IPs for outbound connections from Hyperforce to the customer’s network. These addresses are for products built on the Salesforce platform including Sales, Service, Industries, and Tableau Clouds, and for the MuleSoft Anypoint Platform.

Excluded Services

The JSON list excludes IP addresses for these services: Email, Marketing Cloud, Commerce Cloud, and Slack.

As Hyperforce evolves, Salesforce adds and modifies IP addresses in the JSON file at least 30 days before using the IPs. See Hyperforce IPs to Allow - Sales, Service, Industries, and Tableau Clouds for additional information on subscribing to change notifications and maintaining your router with the latest IPs.

Configure Salesforce Edge for DX

Salesforce Edge is a content delivery network (CDN) that delivers an enhanced network experience, including improved performance, and security such as advanced application security protections. With Edge and AWS DX, your traffic is routed through DX to your target AWS region, then to the nearest available Edge Point of Presence (PoP), and then to your Salesforce organization.

Minimize Latency

• Configure DX to connect to the nearest AWS region to your Hyperforce instance.
• Configure your on-premises DNS servers to connect to the nearest AWS region to your Hyperforce instance.

‎ 

Each DX circuit establishes connectivity to a single AWS region. If you have Salesforce orgs in multiple regions, consider setting up multiple DX circuits.

If you have compliance requirements such as regional data residency or internal security policies, contact your Customer Success Manager to discuss your specific needs.

Allow Short-Term Edge IP ranges

The table Short-Term AWS IP Ranges for Hyperforce Edge contains Salesforce Edge IPs owned by AWS for every region, worldwide, for traffic flowing into Hyperforce. 

Over time, Salesforce plans to relocate Edge IPs into the Hyperforce Public IP ranges at https://ip-ranges.salesforce.com/ip-ranges.json, which Salesforce controls.* Allowing the full set of Hyperforce Public IP ranges preserves your connectivity during the transition. Salesforce recommends revisiting this article periodically so that you’re aware when we retire the AWS ranges, and can remove them from your allowlists.

AWS doesn’t directly advertise the Salesforce Edge ranges. Instead, AWS advertises larger IP ranges, such as /16. To allow Salesforce Edge ranges, find and allow the AWS-advertised ranges that contain the Salesforce Edge ranges from the list at https://ip-ranges.amazonaws.com/ip-ranges.json.

Then, to ensure only the necessary traffic is allowed, configure your firewall to permit traffic only to the specific Salesforce Edge /28 subnet, rather than the entire AWS-advertised /16. To achieve this, apply a BGP import filter or firewall rule that restricts access to the /28 subnet for downstream peers.

AWS owns the IP ranges that they advertise, and can change the ranges at any time. To avoid connectivity disruptions, make a plan to poll the AWS JSON file at regular intervals, and update your firewall rules as needed. After the Edge IPs are relocated into the Hyperforce Public IP ranges, polling, allowing, and filtering the AWS ranges won’t be necessary.

To avoid blocking users, we advise you to allow all the Salesforce IP ranges, because inbound traffic is automatically routed to the Edge closest to the end user’s geographic location. If you only allow the ranges in your country or region, you might block incoming traffic from users in other locations.

Short-Term AWS IP Ranges for Hyperforce Edge

Manage Email IPs

If you plan to route email traffic through the AWS DX circuit, see Route Email Through AWS DX. You must allowlist additional IPs for email.

Test the AWS DX Connection

After you complete setting up AWS DX and provisioning access for Hyperforce and Edge IP addresses, make sure to run performance tests to verify that the AWS DX network path is working properly. Read more in Regular Performance Testing.

Maintain Salesforce Express Connect

Even for Hyperforce customers, a small set of functionality is served only through our non-Hyperforce infrastructure, such as password hints from login.salesforce.com and third-party integrations with *.force.com. If you need these features to be delivered through direct connectivity, you’ll need to maintain a Salesforce Express Connect (SEC) connection until the features are available* on Hyperforce-AWS.

Support

Contact your Customer Success Manager for questions about compliance or data residency.
Contact Salesforce Support for questions about setting up Edge.
Contact AWS or your DX service provider for questions about configuring DX.

* Forward-looking statements apply.

Revision History