Introduction
Organizations using WXP Insights Agent for HP Workforce Experience Platform (WXP) must configure their proxy and firewall settings to allow secure and uninterrupted communication between devices and WXP cloud services.
These configurations support functions such as device enrollment, software udpates, telemetry data transmission, and access to the WXP web portal.
This article provides an overview of the network requirements for WXP and links to the domain and endpoint information for the WXP Insights Agent and WXP web portal.
Supported platforms
The network requirements apply to:
iOS
macOS
Android
Windows
Firewall changes depend on the WXP plans and products purchased.
HP Workforce Experience Platform and WXP Insights Agent
The domain requirements apply to:
WXP Insights Windows Application: version 3.19.357 and later
WXP Insights Analytics: version 4.1.4.2960 and later
HP may update the list of required domains. Update your firewall and proxy settings when the domain requirements change.
When configuring allowlists, consider using wildcards with the fully qualified domain names (FQDNs) listed in the applicable requirements.
AMS Datacenter
Domain | Ports | Description |
www.hpdaas.com | HTTPS/443 | WXP Insights agent endpoint to enroll devices to the entitled company |
downloads.hpdaas.com | HTTPS/443 | Client software distribution endpoint |
downloads.hpanalytics.net | HTTPS/443 | Client software distribution endpoint |
us-west-2.kinesis.hpanalytics.net | HTTPS/443 | WXP Insights Analytics endpoint to upload telemetry data securely to the HP Cloud |
discovery.hpdaas.com | HTTPS/443 | WXP Insights agent endpoint to do discovery of device subscriptions and device region |
iot-us.hpdaas.com * | HTTPS/443 | Device gateway for any communication between the platform and WXP Insights agent |
Optional | ||
bss-usprod.hpdaas.com | HTTPS/443 | WXP Insights agent utilizes an endpoint for uploading BSOD information |
ftp.hp.com | HTTPS/443 | Softpaq downloads from HP |
hpia.hpcloud.hp.com | HTTPS/443 | HP data files for Policy data |
https://catalog.s.download.windowsupdate.com/ | HTTPS/443 | Windows Update downloads for BIOS Update Policies |
EU Datacenter
Domain | Ports | Description |
eu.hpdaas.com | HTTPS/443 | WXP Insights agent communicates to this endpoint for devices in the EU region to discover and enroll to the entitled company. WXP Insights agent prohibits TLS/SSL inspection by any intermediate software/ application or proxy server. |
downloads.hpdaas.com | HTTPS/443 | Client software distribution endpoint |
downloads.hpanalytics.net | HTTPS/443 | Client software distribution endpoint |
us-west-2.kinesis.hpanalytics.net | HTTPS/443 | WXP Insights Analytics endpoint to upload telemetry data securely to the HP Cloud |
discovery.hpdaas.com | HTTPS/443 | WXP Insights agent communicates to this endpoint for devices to discover device subscriptions and device region |
iot-eu.hpdaas.com * | HTTPS/443 | Device gateway for any communication between the platform and WXP Insights agent |
Optional | ||
bss-euprod.hpdaas.com | HTTPS/443 | WXP Insights agent Utilizes an endpoint for uploading BSOD information |
ftp.hp.com | HTTPS/443 | Softpaq downloads from HP |
hpia.hpcloud.hp.com | HTTPS/443 | HP data files for Policy data |
https://catalog.s.download.windowsupdate.com/ | HTTPS/443 | Windows Update downloads for BIOS Update Policies. |
http://www.hpdaas.com/ | HTTPS/443 | Softpaq recommendation metadata for Driver Update Policies |
Note: WXP Insights agent prohibits TLS/SSL inspection by intermediate software applications or proxy servers.
AUS Datacenter
Domain | Ports | Description |
www.hpdaas.com | HTTPS/443 | WXP Insights agent endpoint to enroll devices to the entitled company |
downloads.hpdaas.com | HTTPS/443 | Client software distribution endpoint |
downloads.hpanalytics.net | HTTPS/443 | Client software distribution endpoint |
us-west-2.kinesis.hpanalytics.net | HTTPS/443 | WXP Insights Analytics endpoint to upload telemetry data securely to the HP Cloud |
discovery.hpdaas.com | HTTPS/443 | WXP Insights agent endpoint to do discovery of device subscriptions and device region |
iot-us.hpdaas.com * | HTTPS/443 | Device gateway for any communication between the platform and WXP Insights agent |
Optional | ||
bss-usprod.hpdaas.com | HTTPS/443 | WXP Insights agent utilizes an endpoint for uploading BSOD information |
ftp.hp.com | HTTPS/443 | Softpaq downloads from HP |
hpia.hpcloud.hp.com | HTTPS/443 | HP data files for Policy data |
https://catalog.s.download.windowsupdate.com/ | HTTPS/443 | Windows Update downloads for BIOS Update Policies |
SSL Inspection Software Between Client and Server
If your network uses SSL inspection, configure the inspection software or proxy to bypass the following WXP Insights Agent endpoints:
iot-us.hpdaas.com
iot-eu.hpdaas.com
This requirement applies to both fleet-level and device-level settings.
The WXP Insights Agent does not support TLS/SSL inspection by intermediate software, applications, or proxy servers on these endpoints.
IP Addresses
WXP is cloud-based Software as a Service (SaaS) application that uses load balancers to manage traffic to its communication endpoints. The endpoints are hosted in Amazon Web Services (AWS) and use DNS to resolve the appropriate IP address.
IP addresses are dynamic rather than static. HP does not provide IP addresses for customer firewall or proxy allowlists.
Use the domains listed in this article when configuring allowlists.
Web Portal
When having trouble accessing the web portal, configure the proxy or firewall to allow communication for domains through the following ports:
AMS Datacenter
Domain | Ports | Description |
614310738423-usprodms-asset-export.s3.us-west-2.amazonaws.com | https | Portal: Uploading CSV while importing devices |
614310738423-usprodms-asset-import-errors.s3.us-west-2.amazonaws.com | https | Portal: Download error CSV for errors in asset import |
614310738423-usprodms-daas-foreground-report.s3-us-west-2.amazonaws.com | https | Portal: Download reports |
614310738423-usprodms-daas-logs-lambda.s3.us-west-2.amazonaws.com | https | Portal: Export logs from the logs tab |
614310738423-usprodms-idm-asset-lambda.s3.us-west-2.amazonaws.com | https | Portal: Import assets using CSV |
614310738423-usprodms-idm-asset-unenroll-lambda.s3.us-west-2.amazonaws.com | https | Portal: Import assets to un-enroll using CSV |
614310738423-usprodms-idm-device-remove-lambda.s3.us-west-2.amazonaws.com | https | Portal: Import assets to remove from the portal |
c614310738423-usprodms-idm-user-import-lambda.s3.us-west-2.amazonaws.com | https | Portal: Import users to add |
614310738423-usprodms-logs-export.s3.us-west-2.amazonaws.com | https | Portal: Export logs |
cdn.cookielaw.org | https | Cookie content pops up on the welcome page. |
cdn.jsdelivr.net | https | Microfront end for common UI components in Portal |
oauth.hpbp.io | https | This is an HP domain used for user authentication |
www.hp.com | https | HPID Login Page - Privacy content UI |
client-api.arkoselabs.com | https | HPID Login Page - ReCAPTCHA |
directory.id.hp.com | https | HPID Login Page |
login3.id.hp.com | https | HPID Login Page |
static.id.hp.com | https | HPID Login Page |
ui-backend.id.hp.com | https | HPID Login Page |
ui-backend.us-west-2.id.hp.com | https | HPID Login Page |
www.google.com | https | Google Analytics collection is anonymous, and the site will function even if turned off. |
www.google-analytics.com | https | |
www.tagmanager.google.com | https | |
www.gstatic.com | https | |
stats.g.doubleclick.net | https | HPID Login page - Google Analytics |
login.microsoftonline.com | https | Supports Microsoft AAD login for users |
*.msftauth.net | https | Supports Microsoft AAD login for users |
microui.hpdaas.com | https | Microfront end for common UI components in Portal |
usprod.hpdaas.com | https | Host for APIs, HP domain |
www.hpdaas.com | https | HP domain |
events.launchdarkly.com | https | Launchdarkly is used to control our release of UI as well as Server features to the production environment. It helps us do Canary/Blue Green type deployments. Access to launch darkly is critical for functionality. |
app.launchdarkly.com | https | |
https://catalog.s.download.windowsupdate.com/ | https | Windows Update downloads for BIOS Update Policies. |
EU Datacenter
Domain | Ports | Description |
614310738423-euprodms-asset-export.s3.us-west-2.amazonaws.com | https | Portal: Uploading CSV while importing devices |
614310738423-euprodms-asset-import-errors.s3.us-west-2.amazonaws.com | https | Portal: Download error CSV for errors in asset import |
614310738423-euprodms-daas-foreground-report.s3-us-west-2.amazonaws.com | https | Portal: Download reports |
614310738423-euprodms-daas-logs-lambda.s3.us-west-2.amazonaws.com | https | Portal: Export logs from the logs tab |
614310738423-euprodms-idm-asset-lambda.s3.us-west-2.amazonaws.com | https | Portal: Import assets using CSV |
614310738423-euprodms-idm-asset-unenroll-lambda.s3.us-west-2.amazonaws.com | https | Portal: Import assets to un-enroll using CSV |
614310738423-euprodms-idm-device-remove-lambda.s3.us-west-2.amazonaws.com | https | Portal: Import assets to remove from the portal |
c614310738423-euprodms-idm-user-import-lambda.s3.us-west-2.amazonaws.com | https | Portal: Import users to add |
614310738423-euprodms-logs-export.s3.us-west-2.amazonaws.com | https | Portal: Export logs |
cdn.cookielaw.org | https | Cookie content pops up on the welcome page. |
cdn.jsdelivr.net | https | Microfront end for common UI components in Portal |
oauth.hpbp.io | https | This is an HP domain used for user authentication |
www.hp.com | https | HPID Login Page - Privacy content UI |
client-api.arkoselabs.com | https | HPID Login Page - Recaptcha |
directory.id.hp.com | https | HPID Login Page |
login3.id.hp.com | https | HPID Login Page |
static.id.hp.com | https | HPID Login Page |
ui-backend.id.hp.com | https | HPID Login Page |
ui-backend.us-west-2.id.hp.com | https | HPID Login Page |
www.google.com | https | Google Analytics collection is anonymous, and the site will function even if turned off. |
www.google-analytics.com | https | |
www.tagmanager.google.com | https | |
www.gstatic.com | https | |
login.microsoftonline.com | https | Supports Microsoft AAD login for users |
stats.g.doubleclick.net | https | HPID Login page - Google Analytics |
*.msftauth.net | https | Supports Microsoft AAD login for users |
microui.hpdaas.com | https | Microfront end for common UI components in Portal |
euprod.hpdaas.com | https | Host for APIs, HP domain |
eu.hpdaas.com | https | HP domain |
events.launchdarkly.com | https | Launchdarkly is used to control our release of UI as well as Server features to the production environment. It helps us do Canary/Blue Green type deployments. Access to launch darkly is critical for functionality. |
app.launchdarkly.com | https | |
https://catalog.s.download.windowsupdate.com/ | https | Windows Update downloads for BIOS Update Policies. |
AUS Datacenter
Domain | Ports | Description |
au.hpdaas.com | https | WXP Insights agent communicates to this endpoint for devices in the AUS region to discover and enroll to the entitled company. WXP Insights agent prohibits TLS/SSL inspection by any intermediate software/application or proxy server. |
iot-apse2.hpdaas.com | https | Device gateway for any communication between the platform and WXP Insights agent. |
ap-southeast-2.kinesis.hpanalytics.net | https | WXP Insights Analytics endpoint to upload telemetry data securely to the HP Cloud. |
bss-au.workforceexperience.hp.com | https | WXP Insights agent utilizes an endpoint for uploading BSOD information. Note: Only needed if BSOD dump upload is enabled |
downloads.hpanalytics.net | https/443 | Client software distribution endpoint |
614310738423-auprodms-asset-export.s3.ap-southeast-2.amazonaws.com | https | Portal: Uploading CSV while importing devices |
614310738423-auprodms-asset-import-errors.s3.ap-southeast-2.amazonaws.com | https | Portal: Download error CSV for errors in asset import |
614310738423-auprodms-daas-foreground-report.s3-ap-southeast-2.amazonaws.com | https | Portal: Download reports |
614310738423-auprodms-daas-logs-lambda.s3.ap-southeast-2.amazonaws.com | https | Portal: Export logs from the logs tab |
614310738423-auprodms-idm-asset-lambda.s3.ap-southeast-2.amazonaws.com | https | Portal: Import assets using CSV |
614310738423-auprodms-idm-asset-unenroll-lambda.s3.ap-southeast-2.amazonaws.com | https | Portal: Import assets to un-enroll using CSV |
614310738423-auprodms-idm-device-remove-lambda.s3.ap-southeast-2.amazonaws.com | https | Portal: Import assets to remove from the portal |
c614310738423-auprodms-idm-user-import-lambda.s3.ap-southeast-2.amazonaws.com | https | Portal: Import users to add |
614310738423-auprodms-logs-export.s3.ap-southeast-2.amazonaws.com | https | Portal: Export logs |