Overview

This is a list of Banno’s networks and IP addresses used within our data centers, cloud providers, customer networks, and remote access VPN. It also includes any known JHA services that we consume.

Avoiding Overlap with On-prem

Corporate has reserved 10.230.0.0/16 for workloads that need to egress from GCP across the interconnect to jconnect or corporate addresses. If your workload remains in that reserved range you are guaranteed not to overlap with anything on-prem.

GKE pods should use the 100.64.0.0/10 range: RFC 6598 which GCP supports as a valid range.

Banno Public/jConnect Networks

This Public/jConnect information can be communicated to our customers when they ask, What network or IP will Banno's traffic come from? For specific services or servers please check with someone from the Infra team.

Banno Public Outbound

These are the IP addresses from which traffic from Banno services can come.

Banno jConnect Network Translations

jConnect summaries; 10.90.72.0/24, 10.90.86.0/24, 10.90.100.0/24

A brief note about customer connectivity

Some financial institutions (FI) have their core systems and ancillary products hosted by JHA data centers while others host these services at their own premise. Since not every product is web hardened JHA has provided an encrypted private WAN(jConnect) to connect our FIs to JHA’s services. jConnect is a large private VPN based WAN connecting JHA to almost all of our clients(some CUs use a similar WAN called SymConnect). At last count we had approximately 2500 FIs connected with jConnect. jConnect routers translate our customer’s networks to networks compatible with the JHA WAN and data centers and vice versa.

Banno has jConnect translations setup to allow communication to/from either Lenexa, AWS, or Azure. This is also known as being in an active/active communication posture. This allows systems within LKS and AWS to simultaneously communicate across jConnect to other services or customers independently of one another. This strictly applies to communication readiness, the systems in either site would need to support active/active as well.

Disaster Recovery

We’ve reserved 10.90.100.0/24 for our translated range for customers when we are operating out of AWS in a DR scenario. We will translate our 10.10.{1,3,5}.x ips that use jconnect over to using this range. This lets customers whitelist a network range for LKS and a range for DR. (Previously we had many more networks we requested for them to whitelist.)

Banno Data Center Networks

The data centers have been assigned large summarized network blocks to use immediately and to provide space for expansion in the future.

Assigned

Production

UAT, Staging, Dev

AWS

Azure

SPECIFIC IP ASSIGNMENTS

https://docs.google.com/a/banno.com/spreadsheets/d/1tQLSr1H1yz4J26fAh0746XTmMkawuE9vbgCvV_XPLUs/edit?usp=sharing

Banno Client VPN Networks

Various options and privilege levels exist to connect to Banno production and development. These are the source networks that you’ll be assigned depending on location and privilege level.

LDAP Common Names

Security group common names for active directory

JHA-PSA-F5APMVPN-Banno-Contractor
JHA-PSA-F5APMVPN-Banno-Techops
JHA-PSA-F5APMVPN-Banno-Infrastructure
JHA-PSA-F5APMVPN-Banno-Standard
JHA-PSA-F5APMVPN-Banno-Non-DC

Infrastructure Services

Some of these are provided by ETS and some we (Banno) maintain.

VSPHERE

A list of vsphere endpoints for interacting with JHA hosts

10.203.131.24 lksbnvc01.jkhy.com
10.203.131.23 lksbnpsc01.jkhy.com
10.203.131.25 lksbnpsc02.jkhy.com
10.203.131.26 lksbnvdp01.jkhy.com

NTP (private)

Suggest using Allen as primary and Branson as secondary.

NTP (public restricted access)

For these to work traffic needs to originate from a JHA owned IP block or have our source IP address added to a whitelist.

DNS

These cannot be randomly interchanged. Some of these only service specific domains or environments.

Log Collection

Most system logs are sent to TechOps systems for aggregation and correlation. We also collect Intrusion Prevention System(IPS) logs to syslog.infra.production.lks.banno-internal.com.

JHA Public Networks

JHA owns and operates a few large blocks of public IP space. It is assigned out to our offices and data centers for various purposes. Each network is listed with CIDR notation, sometimes called slash notation for the /##, which indicates a range of addresses rather than a single IP.

Network Summaries

The networks above are dynamic and their physical location is subject to change.