Field Notice: FN - 70304 - New IP Addresses and an Additional URL for Cognitive Threat Analytics Data Ingest Services - Configuration Change Recommended

Notice

THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.

Revision History

Revision	Publish Date	Comments
1.0	02-Oct-18	Initial Release
2.0	11-Aug-20	Updated the Product Hierarchy Information

Products Affected

Affected OS Type	Affected Software Product	Affected Release	Affected Release Number	Comments
NON-IOS	AsyncOS for WSA	11	11.0.0, 11.5.1
NON-IOS	AsyncOS for WSA	10	10.0.0, 10.1.0, 10.1.1, 10.1.2, 10.1.3, 10.5.1, 10.5.1_LD, 10.5.2
NON-IOS	AsyncOS for WSA	9	9.0.0, 9.0.1, 9.1.1, 9.1.2, 9.1.3, 9.2.0
NON-IOS	AsyncOS for WSA	8	8.0.5, 8.0.6, 8.5.0, 8.5.1, 8.5.2, 8.5.3, 8.5.4, 8.6.0, 8.7.0, 8.8.0
NON-IOS	Stealthwatch System Software	6.9	6.9.2
NON-IOS	Stealthwatch System Software	6.10	6.10.2

Defect Information

Defect ID	Headline
CSCvj49222	Cognitive Threat Analytics migrating to AWS Cloud

Problem Description

Cisco Cognitive Threat Analytics (CTA) will be migrated to a new location, which results in new IP addresses and an additional URL for access and use of the service.

Background

In order to help ensure future flexibility and performance, Cisco CTA will be migrated to the Amazon Web Services (AWS) Cloud.

The migration will take place in two phases:

• The first phase covers the migration of the CTA Landing Page, CTA Portal, API Services, and Trusted Automated eXchange of Indicator Information (TAXII) service and has already been completed.
• The second phase covers the migration of the traffic telemetry ingest services.

This field notice covers the changes related to the second phase of the migration only. For more details on the first phase, see FN - 70205 - New URLs and IP Addresses for Cognitive Threat Analytics Front-End and API Access - Configuration Change Recommended.

Switchover Details

The switchover is scheduled to take place between 12 November 2018 and 30 November 2018. After the switchover, you will no longer be able to succesfully send data to the old data ingest services IP addresses.

Problem Symptom

As a consequence of the migration, you might need to perform changes in order to use the service unaffected.

Failure to perform the needed changes might result in the permanent loss of traffic telemetry once Cisco has switched over to the new IP addresses.

Workaround/Solution

The current URLs will stay unchanged, but point to new IP addresses after migration. In order to continue to use the service after the completed switchover, you should make these changes:

1. If you have access control lists (ACLs) in place in your firewall that limit outbound access, and these ACLs are IP address-based, you must add the new IP addresses/ranges. Allow both AWS Elastic IP (EIP) addresses and Cisco IP addresses listed in the table.
2. If you have configured your Web Security Appliance, Cloud Web Security, StealthWatch, or AMP for Endpoint solution with an IP address to point to the CTA Data Ingestion Service, you should change your settings to use the old URL. DO NOT use the new URL in your device configuration at this point, as it will not be operational before the switchover. If you do use the new URL in your device configuration prior to switchover, it will result in the permanent loss of traffic telemetry.

Refer to the tables for the new as well as the current URL and IP address.

Current URL and IP Address

Service Description	Service URL	Service IP Address
CTA data ingest service	https://etr.cloudsec.sco.cisco.com scp+ssh://etr.cloudsec.sco.cisco.com	108.171.128.86

New URL and IP Addresses

Service Description	Service URL	Service IP Address
CTA data ingest service	https://etr.cta.eu.amp.cisco.com scp+ssh://etr.cta.eu.amp.cisco.com https://etr.cloudsec.sco.cisco.com (alias) scp+ssh://etr.cloudsec.sco.cisco.com (alias)	AWS EIPs: 34.251.210.21 34.255.162.33 54.194.49.205 Cisco IPs: 146.112.59.0/24 208.69.38.0/24

For More Information

If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:

• Open a service request on Cisco.com
• By email
• By telephone

Receive Email Notification For New Field Notices

Cisco Notification Service—Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.