Skip to content

W-18970695-app-level-egress-dynamic-IPs #298

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
luanamulesoft wants to merge 3 commits into
base: latest
Choose a base branch
from
Open

W-18970695-app-level-egress-dynamic-IPs #298

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
cc649a5
W-18970695-app-level-egress-dynamic-IPs
luanamulesoft Jul 4, 2025
d777921
updated doc
luanamulesoft Jan 17, 2026
d5455e7
removed incorrect note
luanamulesoft Jan 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 14 additions & 1 deletion cloudhub-2/modules/ROOT/pages/ps-config-app-level-egress.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,8 +165,9 @@ You can't use custom domains with private space internal DNS.

== Performance Impact

Given the extra layer of validation, using the application-level egress rules can introduce three-millisecond to ten-millisecond network latency delays to your applications' connections. To balance security and performance:
Given the extra layer of validation, using the application-level egress rules can introduce three-millisecond to ten-millisecond network latency delays to your applications' connections and in some cases intermittent connection failures. To balance security and performance:

* Use domains with a minimum Time to Live (TTL) of 30 seconds.
* Limit active rule groups to 20 in your private space.
* Use a maximum of 40 rules per rule group.
* Limit the total combination of rule groups and rules to 800.
Expand All @@ -178,6 +179,18 @@ These measures help optimize latency while maintaining effective network securit
[NOTE]
DNS record timing issues can sometimes lead to unexpected connectivity errors. To enhance the reliability of Mule applications, implement robust error handling and connection retry mechanisms.

== Limitations

Application-level egress rules don't support domains that have aggressive Time to Live (TTL) values (under 30 seconds) and rapidly changing IP pools. Egress rules for these domains can cause intermittent connection failures.

Examples of affected endpoints include:

* AWS S3 regional endpoints (for example, `s3.ap-northeast-1.amazonaws.com`) with 5-second TTL
* AWS CloudWatch endpoints with short TTLs
* Other cloud provider endpoints with dynamic IP pools and aggressive TTLs

Avoid configuring application-level egress rules for these scenarios. For more information, see https://help.salesforce.com/s/issue?id=a02Ka00000llC4i[Known Issue: App-level Egress Rules with Low TTL Domains^].

== See Also

* xref:ch2-private-space-about.adoc[]
Expand Down