Staging Firewall Change - Q2 2021

Modified on Wed, May 19, 2021 at 4:23 PM

IMPORTANT NOTICE REGARDING NETWORK ADDRESS CHANGES

FOR CORELOGIC CLAIMS (SYMBILITY) – ACTION REQUIRED

As part of our commitment to the highest level of security and performance, CoreLogic will perform a network migration. Your secure connection to our services will be affected. Some configuration changes will be required on your part.

The following systems will be included in this maintenance:

Claims Connect and Mobile Claims - STAGING (only)
API and Integrations - STAGING (only)

Our IP addresses will change.

This has a direct effect on your security settings.

Scope – Move application firewall

This is scheduled to happen Friday May 28^th around 8:30pm EDT. No downtime is expected.

What this move entails:

The IP address for staging.symbility.net and for downloads-staging.symbility.net will change from 66.203.104.249 to the following:
1. 199.83.128.0/21
2. 198.143.32.0/19
3. 149.126.72.0/21
4. 103.28.248.0/22
5. 45.64.64.0/22
6. 185.11.124.0/22
7. 192.230.64.0/18
8. 107.154.0.0/16
9. 45.60.0.0/16
10. 45.223.0.0/16
11. 2a02:e980::/29

The ciphers we support will change:
1. From (current ciphers):
  - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
  - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  - TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
  - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
  - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
2. To (upcoming ciphers):
  - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
  - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
  - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
  - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
  - TLS_RSA_WITH_AES_128_GCM_SHA256
  - TLS_RSA_WITH_AES_256_GCM_SHA384
  - TLS_RSA_WITH_AES_128_CBC_SHA256
  - TLS_RSA_WITH_AES_256_CBC_SHA256
  - TLS_RSA_WITH_AES_128_CBC_SHA
  - TLS_RSA_WITH_AES_256_CBC_SHA
  - TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
  - TLS_RSA_WITH_CAMELLIA_128_CBC_SHA

The sites will only work with browsers and systems with SNI support

How does this affect clients:

Clients who whitelist IP addresses their users can access need to make sure the IP ranges listed above are whitelisted
Clients who whitelist IP addresses their servers (used for API integration) can access need to make sure the IP ranges listed above are whitelisted
Clients with older systems used for API integration need to make sure their older systems support one of the ciphers above
Only very old browsers (before IE 11) and OS’s (like Windows XP) don’t support SNI
It’s not impossible that clients with older systems used for API integration might have to do something regarding SNI

What’s not affected:

Our outbound IP address doesn’t change in this phase
Our services/servers will remain exactly the same after this change
The SMTP servers we use to send emails will stay the same

Customer Testing

It is highly recommended that customers confirm their API integration works properly with the new IP addresses and ciphers.

https://staging2.symbility.net has already been made available to customers to test our recent Prod-US migration. It can still be used if customers need to test anything regarding to the Staging change. Note that the https://staging2.symbility.net URL is for testing purposes only and will eventually be decommissioned.

Note that even if the test URLs are used, outbound calls done by Claims Connect will still use our current outbound IP address 71.19.185.12 (for Staging).

Also note that the https://staging2.symbility.net URL is for testing purposes only and will eventually be decommissioned.