AEMaaCS Dedicated Egress IP not working as expected

[SrikanthPo3]

Hi,

We have enabled dedicated egress for our AEMaaCS program but when we are making 3rd party REST API calls (Boomi) from AEM server side (OSGi services) the client IP in Azure Front door which is in front of Boomi does not match with AEMaaCS dedicated egress IP as a result we see http status 502 with mesasage something like "Azure Front door cannot connect to the origin server." We noticed that client IP is changing frequently.

Command nslookup p<Program ID>.external.adobeaemcloud.com - gives us the correct dedicated egress IP which has been whitelisted in Azure Front door of target/Boomi.

Can anyone help us with a solution for this issue? Do we need to change the implementation of HttpClient connection call?

[Karishma_begumSh]

Hi @SrikanthPo3 

1. Ensure Advanced Networking > Dedicated Egress IP is enabled and active.
2. Modify our HTTP client in the OSGi service to use .useSystemProperties() or explicitly read AEM_PROXY_HOST and AEM_HTTP_PROXY_PORT environment variables.
3. Re‐test and verify the outgoing IP from both Author & Publish.
4. Then update Azure whitelist with the confirmed dedicated IP.”

Some useful sources

• Dedicated Egress IP Address (AEMaaCS) — Adobe Experience League
  Detailed doc on how to enable dedicated egress IP, the prerequisites, DNS lookup, and HTTP/HTTPS connection rules.
  Experience League

• Advanced Networking | AEM as a Cloud Service — Adobe Experience League
  Explains the advanced networking options (Dedicated Egress IP, Flexible Port Egress, VPN) and how they apply.
  Experience League+2Experience League+2

• HTTP/HTTPS Connections for Dedicated Egress IP Address and VPN — Adobe Experience League
  Contains code example showing how HTTP/HTTPS calls are routed through the dedicated egress IP in AEMaaCS.
  Experience League

• Assets HTTP API | AEM Assets — Adobe Experience League
  Developer reference for the REST/HTTP API to perform asset operations (create, read, update, delete) in AEMaaCS.
  Experience League

• AssetManager API Reference (AEM 6.x) — Adobe Developer Javadoc
  Useful for legacy AEM deployments (non-cloud) to understand the Assetmanager interface.
  Adobe Developer+1

• Community/Blog Articles — Real-world scenarios and troubleshooting

  • “Demystifying Dedicated Egress IPs in AEM Cloud Services” — blog article. albinsblog.com

  • Community post about outbound traffic issue in AEMaaCS. Adobe Experience League Communities

Regards,

Karishma.

[Mahedi_Sabuj]

Hi @SrikanthPo3, 

Some libraries require explicit configuration to use standard Java™ system properties for proxy configurations. Otherwise, they may continue to use the shared IP when sending requests to the client.

try (CloseableHttpClient httpClient = HttpClientBuilder.create()
    .setDefaultRequestConfig(getRequestConfig())
    .useSystemProperties() // this line makes the magic
    .build()) {
    // Implementation goes here
}​

More details available here: https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/security/configu...

[giuseppebaglio]

hi @SrikanthPo3, 

This page appears to correspond with your symptoms. Outbound API calls use inconsistent IPs in AEMaaCS.

Ensure your Boomi endpoint is not listed in the Non-Proxy Hosts parameter. Any hosts in this list will bypass the dedicated egress IP and use shared IPs instead.