In order to successfully establish a connection to the BlackBerry Infrastructure when the BlackBerry Enterprise Server is behind a firewall, complete the following:

1. On the firewall, verify that port 3101 is open for outbound initiated, bi-directional, Transmission Control Protocol (TCP) traffic.
   
   
2. Configure your firewall with the following addresses on the allowed list
   
   
   

   	IP Address		Netmask
   	193.109.81.0 / 24		255.255.255.0
   	93.186.16.0 / 20		255.255.240.0

   
                                          
   
• Ideally, complete IP address ranges should be allowed through your corporate firewall.
  
  If your BlackBerry Enterprise Server is configured to connect through the Europe, Middle East, and Africa (EMEA) region and you are unable to allow ranges through due to configuration restrictions, you may allow individual IP addresses for EMEA.
  
  The EMEA ranges 193.109.81.0 / 24 and 93.186.16.0 / 20 only may be replaced by the following list of IP addresses.
  
  The individual IP addresses that must be allowed through the firewall for customers who connect a BlackBerry Enterprise Server through the EMEA region are:
  
  

  	93.186.25.32		93.186.25.36		93.186.17.32		93.186.17.36
  	93.186.25.33		93.186.25.37		93.186.17.33		93.186.17.37
  	93.186.25.34		93.186.25.38		93.186.17.34		93.186.17.38
  	93.186.25.35		93.186.25.39		93.186.17.35		93.186.17.39
  	193.109.81.33

  
      
  
3. Verify the connection settings by completing the following steps:
   
   
• Open the BlackBerry Server Configuration tool.
  
  
• Select the BlackBerry Router tab.
  
  
  
  
  
  Do not specify an IP address in the SRP Address field because the BlackBerry Enterprise Server may lose the connection if the Server Routing Protocol (SRP) address is updated. The SRP address will appear as srp.xx.blackberry.net, where xx is the region, e.g. srp.ie.blackberry.net.