Skip to content
Swiss federal authorities

Backend IP address change🔗

On 2 December 2026 at 12:00 CET, the network endpoints used by the sedex-Client to connect to the sedex backend will change.

In short

  • The sedex-Client continues to connect to sedex-service.admin.ch.
  • No sedex-Client configuration change is required.
  • The IP address behind this DNS name will change.
  • Separate IP addresses will be used for Internet access and for access from the Federal Administration network.
  • If your firewall, proxy, or other network security component restricts outbound connections by destination IP address, the relevant new IP address must be allowed before 2 December 2026, 12:00 CET.
  • You can test connectivity to the new infrastructure in advance.
  • If the test fails, please contact sedex support by 11 November 2026 so that there is sufficient time for analysis before the migration.

What is changing?🔗

The sedex-Client communicates regularly with the central sedex backend over HTTPS.

For this connection, the client uses the DNS name:

sedex-service.admin.ch

DNS resolves this name to an IP address. Until now, the same backend IP address has been used for both Internet access and access from the Federal Administration network.

As part of a network infrastructure migration, this will change:

  1. The DNS name sedex-service.admin.ch remains unchanged.
  2. The IP address behind the DNS name will be replaced.
  3. Backend access will be separated into two network paths:
  4. access via the Internet
  5. access from the Federal Administration network

New IP addresses🔗

Access path Current IP address New IP address Port Protocol
Internet 162.23.132.34 162.23.184.16 443 HTTPS / TCP
Federal Administration network 162.23.132.34 10.179.3.214 443 HTTPS / TCP

After the migration, the previous IP address 162.23.132.34 will no longer be used for this service.

What this means for your sedex-Client

Do not replace sedex-service.admin.ch with an IP address in the sedex-Client configuration.

The sedex-Client must continue to use the DNS name. Only network components that restrict outbound traffic by destination IP address may require an adjustment.

Do I need to take action?🔗

Use the following decision guide:

If outbound HTTPS connections from the sedex-Client are not restricted to specific destination IP addresses, no network configuration change is expected.

The client continues to connect to:

https://sedex-service.admin.ch

If your firewall, proxy, allowlist, or another security component restricts outbound traffic by destination IP address, update the corresponding rule before the migration.

Allow outbound HTTPS/TCP traffic on port 443 to:

  • Internet: 162.23.184.16
  • Federal Administration network: 10.179.3.214

Ask the team responsible for your network, firewall, or proxy whether outbound access from the sedex-Client to sedex-service.admin.ch is restricted by destination IP address.

You can also perform the connectivity test described below.

Test the new connection in advance🔗

A dedicated DNS name is available for testing the new network path before the migration:

sedex-service-new-ip.admin.ch

Test endpoint only

sedex-service-new-ip.admin.ch is provided only for pre-migration connectivity tests.

Do not configure it as the productive backend endpoint. The productive sedex-Client continues to use sedex-service.admin.ch.

Functional test🔗

Open or request:

https://sedex-service-new-ip.admin.ch/monitoring/accesstest/hello.html

A successful request returns HTTP status 200 with:

Here is sedex.

Command-line tests🔗

PowerShell or Command Prompt with curl

curl.exe https://sedex-service-new-ip.admin.ch/monitoring/accesstest/hello.html

Test TCP connectivity with PowerShell

Test-NetConnection -ComputerName sedex-service-new-ip.admin.ch -Port 443

Check DNS resolution

nslookup sedex-service-new-ip.admin.ch

Test the HTTPS endpoint

curl https://sedex-service-new-ip.admin.ch/monitoring/accesstest/hello.html

Test TCP connectivity

nc -vz sedex-service-new-ip.admin.ch 443

Check DNS resolution

nslookup sedex-service-new-ip.admin.ch

If available, you can alternatively use:

dig sedex-service-new-ip.admin.ch

Verify the resolved IP address🔗

The IP address returned for the test hostname depends on the network from which the request is made.

Your connection Expected IP address
Internet 162.23.184.16
Federal Administration network 10.179.3.214

Tip

Run the test from the same network environment in which the sedex-Client operates. A successful test from a workstation in another network does not necessarily verify connectivity for the sedex-Client.

Migration schedule🔗

Date and time Activity
Before 11 November 2026 Perform connectivity tests. If the test fails, contact sedex support so that there is sufficient time for analysis before the migration.
Before 2 December 2026 Adapt network rules if required and verify connectivity to the new endpoint.
1 December 2026 The DNS TTL for sedex-service.admin.ch will be reduced to one minute to support a fast rollback if necessary.
2 December 2026, 12:00 CET DNS for sedex-service.admin.ch will be switched to the new IP addresses.
After successful migration The previous IP address 162.23.132.34 will no longer be used. Obsolete firewall rules can be removed if they are no longer required.

Troubleshooting🔗

If the test fails, check the following in order:

  1. DNS resolution
    Verify that sedex-service-new-ip.admin.ch resolves successfully and returns the IP address expected for your network.

  2. TCP connectivity
    Verify that the host running the sedex-Client can establish an outbound TCP connection to port 443.

  3. Firewall and proxy rules
    Check whether outbound connections are restricted by destination IP address.

  4. Network path
    Make sure the test is executed from the same network environment as the sedex-Client.

  5. HTTPS request
    If DNS and TCP connectivity work, test the HTTPS endpoint and verify that it returns HTTP 200.

The test still fails?

Please contact sedex support by 11 November 2026 if the connection still fails after the required network access has been verified.

This allows sufficient time to determine whether the issue is related to the sedex infrastructure before the migration.

Configuration and troubleshooting of participant-specific firewalls, proxies, and other network components remain the responsibility of the participant's IT organisation.

Frequently asked questions🔗

Do I have to change the sedex-Client configuration?

No. The productive DNS name remains sedex-service.admin.ch. No sedex-Client configuration change is required because of this IP address migration.

Why are there two new IP addresses?

Backend access is being separated into two network paths: one for access via the Internet and one for access from the Federal Administration network.

Which IP address do I need?

This depends on the network from which your sedex-Client connects:

  • Internet: 162.23.184.16
  • Federal Administration network: 10.179.3.214
What happens if our firewall still allows only the old IP address?

If outbound access is restricted to the previous IP address, the sedex-Client will no longer be able to reach the backend after the migration.

Can I already test the new IP address?

Yes. Use sedex-service-new-ip.admin.ch as described in the test section.

Can I configure the test hostname permanently?

No. The test hostname is intended only for connectivity testing. The productive sedex-Client must continue to use sedex-service.admin.ch.