Use static egress when a Destination, firewall, or API will accept Cribl.Cloud traffic only from a known source IP. By default, Cribl.Cloud uses public egress, and those outbound addresses can change when Cribl rescales infrastructure. Static egress keeps the outbound traffic in a region on a stable set of IPs that you can add to an allowlist once.

Typical cases, when Cribl.Cloud makes the outbound connection:

• A SaaS Destination such as Splunk Cloud that requires an IP allowlist and does not accept FQDN-based rules.
• An on-prem firewall or security group that can allow only specific source addresses.
• A self-hosted HashiCorp Vault server whose allowlist must include the Cribl.Cloud Leader. See Self-Hosted HashiCorp Vault and IP Allowlists.

Static egress still sends traffic over the public internet. If the Destination can use a private path, you might prefer to use Private Link instead. You should enable static egress per region only where you need a stable source IP.

Enable or Disable Static Egress ​

You can configure static egress in the Cribl.Cloud portal. You need the Admin or Owner Permission on the Workspace.

1. In the sidebar, select Workspace, then Connections.
2. Select the Static Egress IP tab.
3. Select one or more regions that share the same Status. You can’t enable and disable regions in the same action.
4. Select Enable Static Egress IP or Disable Static Egress IP.
5. Review the region list in the confirmation dialog, then select Enable or Disable.

When you enable or disable static egress, you can’t access the Workspace UI for approximately 15 minutes. Data will continue to flow through the Workspace during that window.

After you enable a region, the Status changes to Enabled before addresses appear. Wait until the Static Egress IP column lists IP addresses, then copy every address into your Destination or firewall allowlist. Do not allowlist the region while the column still shows Provisioning static IP addresses….

After you disable a region, those IPs are no longer used. Update downstream allowlists so they no longer depend on the removed addresses, or traffic to those Destinations can fail.

Static egress IPs are not the same as Leader NLB IPs on Workspace > Access. Leader NLB IPs are inbound addresses for hybrid connectivity to the Leader. Static egress IPs are outbound addresses for traffic that Cribl.Cloud sends to Destinations, Collectors, and similar pull paths.