Firewall allowlisting for Esper-managed devices: URLs and ports instead of IP whitelisting

Android

When preparing to deploy Esper-managed devices across your network, you don't need to submit public IP addresses to Esper for whitelisting. Instead, you only need to allowlist specific URLs and ports at your firewall level. This article explains why and how to set up your network correctly.

Before you begin

Esper's infrastructure uses dynamic IP addresses that change over time—a common practice for cloud-hosted services. Because of this, IP-based whitelisting is both impractical and unnecessary. Esper connectivity works through outbound HTTPS and MQTT connections to specific hostnames, so URL and port allowlisting is the correct approach.

How to allowlist Esper URLs and ports

Get the official Esper firewall requirements from your Esper Support team or visit the Firewall Requirements help article.
Share the firewall requirements list with your network or IT team.
Ask your network team to allowlist all URLs and ports from that list on your firewall or proxy. No IP addresses need to be collected or submitted to Esper.
If your devices will connect through an unrestricted network with no firewall or content filtering, no firewall changes are needed—you can proceed with provisioning immediately.

Verify connectivity after provisioning

Provision one pilot device at your site.
In the Esper Console, go to Devices & Groups and check that the device appears as Online.
Test a remote command, such as a reboot or ping. If the command executes successfully, your network connectivity is fully established.

Troubleshooting: devices won't connect

If devices remain offline after allowlisting the URLs and ports, check the following:

SSL inspection or MITM proxies: Some firewall or proxy appliances perform TLS inspection (also called MITLS) that can break Esper's MQTT or HTTPS connections even when URLs are technically allowed. Ask your IT team whether your proxy performs TLS inspection. If it does, they may need to create a TLS inspection bypass for Esper domains.
Captive portals: If your network uses a captive portal, devices cannot connect to Esper until the portal is dismissed. Confirm with your IT team whether a captive portal is blocking traffic.
Review Esper Agent logs: Pull logs from an affected device to identify the specific connection failure:
```
adb logcat -s Esper Agent
```
Ensure complete allowlisting: Verify that your IT team has allowlisted all required URLs, not just a subset. For example, allowlisting only MQTT ports while blocking other endpoints will result in degraded functionality or complete connection failure.

Important notes

This guidance applies to all Esper-managed Android devices, regardless of manufacturer or model.
Esper does not offer a per-account IP whitelisting process. You should not need to submit static IP addresses to Esper.
If your organization operates in a regulated environment (such as healthcare or PCI-compliance zones), confirm with your compliance or security team that outbound URL-based allowlisting is permitted before proceeding.
The Firewall Requirements article includes all endpoints needed for device management, telemetry, app delivery, and remote access. Partial allowlisting will not work.

Still need help?

If devices cannot connect after following these steps and you've verified your firewall configuration, contact Esper Support. include the following information:

Esper Agent logs from an affected device (see the troubleshooting section above)
Your firewall or proxy vendor and model
A description of your network environment
Confirmation that you've allowlisted all URLs and ports from the Firewall Requirements article