Prod-CA Server Migration - Q1 2023

IMPORTANT NOTICE REGARDING NETWORK ADDRESS CHANGES

FOR CORELOGIC CLAIMS (SYMBILITY) – ACTION REQUIRED

As part of our commitment to the highest level of security and performance, CoreLogic will perform a network migration.

Your secure connection to our services will be affected.  Some configuration changes will be required on your part.

The following systems will be included in this maintenance:

• Claims Connect and Mobile Claims - ca.symbility.net 
• API and Integrations - ca.symbility.net
• BI Reports - bi-ca.symbility.net
• Downloads - downloads-ca.symbility.net
• SFTP Data Site - sftp-ca.symbility.net

Changes will be done in 2 phases:

1. Phase 1 – Move application firewall on Friday January 27th around 9:00pm EST

2. Phase 2 – Move servers on Saturday February 11th around 1:00am EST

Our IP addresses will change.

This has a direct effect on your security settings.

Phase 1 – Move application firewall

This phase is currently scheduled to happen Friday January 27th around 9:00pm EST.

No downtime is expected and this move is technically simple for us to perform.

What this move entails:

• The IP address for ca.symbility.net, for downloads-ca.symbility.net and for bi-ca.symbility.net will change from 20.48.135.148 to the following:
  • 199.83.128.0/21
    
  • 198.143.32.0/19
  • 149.126.72.0/21
  • 103.28.248.0/22
  • 45.64.64.0/22
  • 185.11.124.0/22
  • 192.230.64.0/18
  • 107.154.0.0/16
  • 45.60.0.0/16
  • 45.223.0.0/16
  • 2a02:e980::/29
  • 131.125.128.0/17  ◄ Added April 2023 following a maintenance notice

• The ciphers we support will change: 
  • From (current ciphers):
    • TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
    • TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
    • TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
    • TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
    • TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
  • To (upcoming ciphers):
    • TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    • TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
    • TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
    • TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
    • TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
    • TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
    • TLS_RSA_WITH_AES_128_GCM_SHA256
    • TLS_RSA_WITH_AES_256_GCM_SHA384
    • TLS_RSA_WITH_AES_128_CBC_SHA256
    • TLS_RSA_WITH_AES_256_CBC_SHA256
    • TLS_RSA_WITH_AES_128_CBC_SHA
    • TLS_RSA_WITH_AES_256_CBC_SHA
    • TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
    • TLS_RSA_WITH_CAMELLIA_128_CBC_SHA

How does this affect clients:

• Clients who whitelist IP addresses their users can access need to make sure the IP ranges listed above are whitelisted
• Clients who whitelist IP addresses their servers (used for API integration) can access need to make sure the IP ranges listed above are whitelisted
• Clients with older systems used for API integration need to make sure their older systems support one of the ciphers above
• Only very old browsers (before IE 11) and OS’s (like Windows XP) don’t support SNI.  Older systems used for API integration may have issues with the SNI requirement

What’s not affected:

• Our outbound IP address doesn’t change in this phase (it changes in phase 2 below)
• Our services/servers will remain exactly the same after this change (they change in phase 2 below)
• The SMTP servers we use to send emails will stay the same, but a migration is planned in a few of months
• The data export / data dumps SFTP sites used by our customers will stay the same (sftp.symbility.net / no IP address changes), but a migration is planned in a few of months
• https://staging.symbility.net is not affected

Phase 2 – Server Migration

This phase is scheduled to happen Saturday February 11th around 1:00am EST during our maintenance window.  A downtime of 1 to 2 hours can be expected.

What this move entails:

• The outbound IP address of our APIs will change from 20.48.135.148 to the following:
  • 35.203.114.224/28
  • 34.130.18.128/28

How does this affect clients:

• Clients who whitelist IP addresses their servers (used for API integration) can access need to make sure the outbound IP addresses listed above are whitelisted
• If data export customers whitelist the IP address of the SFTP server (sftp-ca.symbility.net), they will need to make sure that the new SFTP IP addresses listed above are whitelisted
• The daily data export jobs / data dumps will not be running that weekend and the next files will be generated Monday very early morning

Customer Testing

It is recommended that customers confirm their API integration works properly with the new IP addresses and ciphers.

• Customers with accounts on Staging can start testing this today using https://staging.symbility.net – Staging has been using the latest IP addresses and ciphers for more than a year.

▼ Click below to download a copy of this information ▼