Configuring Network Whitelisting for CyberSource Services

Introduction

This knowledge article explains how to properly configure network whitelisting for CyberSource services to ensure secure and reliable payment processing. The procedures outlined apply to all regions where CyberSource services are utilized and are relevant for merchants, payment processors, and technical teams responsible for network security configurations. This article covers domain-based and IP address-based whitelisting approaches for standard CyberSource services, Secure Acceptance services, and new POST notification services.

Procedure Steps

1. Identify your CyberSource service requirements
   Determine which CyberSource services you are using: standard payment processing, Secure Acceptance services, or services requiring POST notifications (Decision Manager, PayPal IPN).
2. Configure primary domain whitelisting
   Add the cybersource.com domain to your network whitelist as the primary configuration method.
3. Add IP address ranges if domain whitelisting is insufficient
   If domain whitelisting does not meet your requirements, add the complete CyberSource IP range: 66.185.176.1 - 66.185.191.254 or 66.185.176.0/20.
4. Perform nslookup for current IP addresses (alternative approach)
   Execute an nslookup command for the cybs-gw.ic3.com domain and add the returned IP addresses to your whitelist if you prefer to use only currently active IP addresses.
5. Configure Secure Acceptance IP ranges (if applicable)
   Add the following IP address ranges to your whitelist if you use any Secure Acceptance services:
   • 198.241.162.1 - 198.241.162.254
   • 198.241.168.1 - 198.241.168.254
   • 198.241.206.1 - 198.241.206.254
   • 198.241.207.1 - 198.241.207.254
6. Add POST notification IP addresses (if applicable)
   Include the following specific IP addresses in your configuration if you receive Order Notification messages, Order Status Notification messages, or PayPal Instant Payment Notification messages:
   • 198.241.206.21
   • 198.241.207.21
7. Test your configuration
   Verify that your payment processing and notification services function correctly after implementing the whitelist changes.
8. Schedule periodic IP address updates
   Establish a routine to periodically re-run nslookup commands to identify any new IP addresses that may need to be added to your whitelist.

CyberSource IP Address Ranges

Service Type	IP Address Range	Purpose
Standard CyberSource	66.185.176.1 - 66.185.191.254	Primary payment processing
Secure Acceptance	198.241.162.1 - 198.241.162.254	Secure Acceptance notifications
Secure Acceptance	198.241.168.1 - 198.241.168.254	Secure Acceptance notifications
Secure Acceptance	198.241.206.1 - 198.241.206.254	Secure Acceptance notifications
Secure Acceptance	198.241.207.1 - 198.241.207.254	Secure Acceptance notifications
POST Notifications	198.241.206.21	Asynchronous transaction updates
POST Notifications	198.241.207.21	Asynchronous transaction updates

Potential Client Questions

The recommended approach is to add the cybersource.com domain to your whitelist, as this covers most use cases and automatically adapts to IP address changes.

Use IP address ranges when domain whitelisting is not sufficient for your network security requirements or when your firewall configuration requires specific IP addresses.

Yes, Secure Acceptance services use different IP address ranges and require additional whitelist entries beyond the standard CyberSource configuration.

IP addresses do not change frequently, but you should periodically re-run nslookup commands to catch any new addresses that may be added.

Order Notification messages from Secure Acceptance, Order Status Notification messages from Decision Manager, and PayPal Instant Payment Notification messages require the additional POST IP ranges.

Glossary

• BYOD: Bring Your Own Device
• IPN: Instant Payment Notification
• POST: HTTP POST method for sending data
• nslookup: Network administration command-line tool for querying Domain Name System records