Migrate a Rapid7-hosted external Scan Engine

Rapid7 is migrating its hosted External Scan Engines to Amazon Web Services (AWS) as part of a planned infrastructure upgrade. The Scan Engines will be hosted in the same region as your Rapid7 Command Platform, which means moving to a regional scanning setup. Your existing Scan Engines will remain available during the transition period.

Rapid7 manages the infrastructure migration and regional placement. To maintain scanning connectivity, you must complete the applicable network and Security Console configuration updates.

This upgrade introduces the following changes:

• IP addresses - Your existing External Scan Engine IP addresses will be replaced with new IP addresses.
• Network connectivity - You may need to update firewall rules, network access rules, or allowlists to permit communication with the replacement Scan Engines.
• Scan Engine configuration - Depending on your pairing configuration, you may need to add replacement Scan Engines to your Security Console.
• Scan site assignments - You may need to update scan sites to use the replacement Scan Engines.

Before you begin

Complete the applicable configuration updates and validate scanning by February 26, 2027. Complete these steps by the deadline to avoid disruption to your Scan Engines. Before you can start the migration, you need:

• Administrator access to the Security Console
• Your migration notification, which includes your existing and replacement Scan Engine IP addresses.

Migration timeline

The migration follows these stages:

Identify your Scan Engine pairing configuration

The procedure you need to follow depends on how your Rapid7 Security Console communicates with your hosted External Scan Engines.

To check your Scan Engine pairing configuration:

1. In your Rapid7 Security Console, go to Administration > Scans > Engines.
2. In the Communication Status column, check the arrow:
   • If it points toward Engine (Console → Engine), follow the instructions for Option 1, Console-to-Engine pairing.
   • If it points toward Console (Engine → Console), follow the instructions for Option 2, Engine-to-Console pairing.

Option 1: Console-to-Engine pairing

Use these instructions if your Rapid7 Security Console initiates connections to your hosted External Scan Engines.

Task 1: Update your firewall rules

Update your firewall or network access outbound rules to allow communication from your Security Console to the replacement Scan Engine IP addresses.

• Destination - New hosted Scan Engine IP addresses
• Port - TCP 40814
• Direction - Outbound from your Security Console
• IP Addresses - Replacement IP addresses provided in your migration notification

Task 2: Add the replacement Scan Engines to your Security Console

1. From your Rapid7 Security Console, go to Administration > Scans > Engines.
2. Select New Engine.
3. On the General tab, enter a descriptive name, such as Rapid7 External Scan Engine.
4. In the Address field, enter the replacement Scan Engine IP address provided by Rapid7.
5. Leave the default port set to 40814.
6. Select Save.

Repeat these steps for each additional replacement Scan Engine.

Task 3: Verify Scan Engine connectivity

The Scan Engine should reconnect automatically after the required network access is configured.

To verify connectivity:

1. From your Rapid7 Security Console, go to Administration > Scans > Engines.
2. Locate your External Scan Engine.
3. Confirm that the engine status shows Online (green arrow).
4. If the Scan Engine does not appear online, review your firewall rules and verify that the correct IP address and port have been configured.

Task 4: Update your scan sites

If your scan sites are configured to use the previous External Scan Engines, update them to use the replacement Scan Engines.

Review each affected scan site and select the appropriate replacement Scan Engine. For additional guidance, see Create and Edit Sites .

Task 5: Validate scanning

Run a scan using the replacement External Scan Engine.

Confirm that:

• The replacement Scan Engine is online.
• The scan starts successfully.
• The scan completes as expected.
• The correct Scan Engine is assigned to the scan site.

Option 2: Engine-to-Console pairing

Use these instructions if your External Scan Engines initiate connections to your Rapid7 Security Console.

Task 1: Update your firewall rules

• Update your firewall or network access inbound rules to allow connections from the replacement External Scan Engine IP addresses to your Security Console.
• Use the replacement IP addresses provided in your migration notification.
• Ensure that your existing Security Console communications work as expected.

Task 2: Verify Scan Engine connectivity

The Scan Engine should reconnect automatically after the required network access is configured.

To verify connectivity:

1. From your Rapid7 Security Console, go to Administration > Scans > Engines.
2. Locate your External Scan Engine.
3. Confirm that the engine status shows Online (green arrow).
4. If the Scan Engine does not appear online, review your firewall rules and verify that the correct IP address and port have been configured.

Task 3: Review scan site assignments

• Review the scan sites associated with your External Scan Engine.
• Update the Scan Engine assignment if required.
• For additional guidance, see Create and Edit Sites .

Task 4: Validate scanning

Run a scan using the External Scan Engine.

Confirm that:

• The Scan Engine is online.
• The scan starts successfully.
• The scan completes as expected.
• Your scan sites continue using the appropriate Scan Engine.

Troubleshooting

The most common issues and their solutions are covered in this section.