Need assistance to whitelist IPs of Dialogflow fulfilment request for firewall

Question

I am evaluating Dialogflow ES Trail and created an agent, with fulfillment to explore the features.

For that, I have configured the application service in the Dialogflow console in fulfillment and specified the application endpoint URL for the service that is hosted on our secure network and environment. When a specific intent matches that have the fulfillment enabled it will invoke the service that is configured, but there is a failure "Dialogflow fulfillment error: Webhook call failed. Error: DEADLINE_EXCEEDED." since this request is getting blocked on our firewall. Please note we are not hosted on the google cloud platform and using other cloud services and also we are using a different firewall that has custom rules.

I'm seeking assistance with whitelisting the IP addresses or DNS from which Google Dialogflow fulfillment is sending the traffic since this seems to be dynamic and changing every time the requests are getting blocked on our firewall.

I went through this documentation and tried allowing the IP Address ranges specified, but the IP addresses from which Google is sending the traffic are different. Also, it seems like this is more specific to Google Cloud Platform

https://cloud.google.com/vpc/docs/access-apis-external-ip#config

Also configuring the dynamic IP addresses ranges from these files goog.json and cloud.json hosted on the internet which keeps on updating daily seems to be difficult to handle in our firewall

https://cloud.google.com/vpc/docs/access-apis-external-ip#ip-addr-defaults

Can anyone please help me with How I can whitelist dialogflow.cloud.google.com traffic to our firewall since their IP Address and DNS is dynamic?

Answer 1

I recommend you to forgive this solution and to accept the traffic! Ok, surprising, let me explain.

If you whitelist the Dialogflow URL or IP, all the users that use Dialogflow will be authorized on your firewall. And because anyone can use Dialogflow, you will open the firewall to everybody.

Thus, don't waste time with that. "Don't trust the network" as Google say, but trust the authentication of the request. You can set, at least a static "API Key" on your webhook calls, it's much better than IP Filtering (even if not so strong, it's still better).

I recommend you to focus on this solution instead.