Connections in Vince Live can be configured to use static IPs, for instance when accessing services within an on-prem network. When doing so, all traffic for that connection will be routed through a gateway to use one of three IP addresses.
These addresses need to be whitelisted in the firewall.
(Click image and press space to enlarge)

To access ION API Gateway, two HTTPS endpoints need to be allowed once allowed through the firewall:
Vince Live does not need access to any other endpoints within the network - all traffic to services within the network will be going via ION API Gateway.
If the domains in the generated ION API Config file are internal domains that differ from the public domains and ports, they need to be changed in the file to the public domains and ports accessible from the internet. The file can be changed by using a text editor.