Can we enable NCC‑managed stable public egress on existing NCC by ourselves via UI?

[david888]

We have an existing NCC named gtcDataLake on us‑west‑2.
At present NCC‑managed stable public egress has not been enabled for this NCC.

Our Serverless compute cannot establish connection to an Alibaba Cloud ECS HAProxy server
Traceroute from serverless notebook shows traffic gets blocked at intermediate network node with !X Administratively prohibited.

We have already set workspace‑level context‑based egress policy to Full, but this setting does not override the underlying NCC network restriction.

My questions:
1. Is there any UI setting that account admin can use to turn on NCC‑managed stable public egress?
2. Does this feature have to be enabled by Databricks backend support team via support ticket only?

Our scenario:
We are doing POC for Lakeflow‑Ingest CDC. We need serverless replicant to connect to MySQL via HAProxy hosted on Alibaba Cloud ECS.

[ThomazNeto]

Hi David,

Two things here, and the second one probably matters more for your POC.

1. NCC-managed stable IPs don't exist anymore. The docs say the legacy stable IP list "was deprecated on May 25, 2026" and "was decommissioned and is no longer available through the NCC UI or Network Connectivity API". So there's no toggle for you to flip and no ticket that will turn it on. The replacement is a published JSON of outbound IPs, ip-ranges.json, filtered by service Databricks, type outbound, platform aws and your region. Allowlist those prefixes on the Alibaba side (security group and HAProxy host firewall), and automate the refresh, because the list can change every 30 days with new IPs active 60 days after publication. Until you do that, serverless will keep hitting exactly what your traceroute shows.
https://docs.databricks.com/aws/en/security/network/serverless-network-security/serverless-firewall-...
https://docs.databricks.com/aws/en/resources/ip-domain-region

Your network policy set to Full access is correct but unrelated: it controls which destinations serverless may reach, not which IPs it comes from.
https://docs.databricks.com/aws/en/security/network/serverless-network-security/network-policies

2. For Lakeflow Connect MySQL CDC you may not need serverless egress at all. The docs split the connector in two: the ingestion gateway, which reads the binlog and "runs on classic compute, and it runs continuously", and the ingestion pipeline, which runs on serverless but reads from the staging volume, not from MySQL. So the component that has to reach your HAProxy is a classic cluster in your own VPC, and connectivity is your VPC's NAT and routing to Alibaba, which you control. Worth testing from a classic cluster before spending more time on the serverless path.
https://docs.databricks.com/aws/en/ingestion/lakeflow-connect/cdc-overview

If you do need serverless to reach that host for other reasons, the other option is PrivateLink from serverless to an NLB in your VPC (Enterprise tier, and the overview page still lists private connectivity as private preview via account team).
https://docs.databricks.com/aws/en/security/network/serverless-network-security/pl-to-internal-netwo...

Hope this helps.