Field Notice: FN - 70205 - New URLs and IP Addresses for Cognitive Threat Analytics Front-End and API Access - Configuration Change Recommended

Available Languages

Updated:May 29, 2018
Document ID:FN70205

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Notice

THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.

Revision History

Revision Publish Date Comments
1.0
28-May-18
Initial Release

Products Affected

Affected OS Type Affected Release Affected Release Number Comments
NON-IOS
11
11.0.0
NON-IOS
10
10.1.0, 10.0.0, 10.1.1, 10.1.2, 10.5.1, 10.1.3, 10.5.1_LD
NON-IOS
9
9.1.1, 9.0.0, 9.0.1, 9.1.3, 9.2.0, 9.1.2
NON-IOS
8
8.0.6, 8.5.0, 8.5.1, 8.0.5, 8.8.0, 8.7.0, 8.5.3, 8.5.2, 8.5.4, 8.6.0
NON-IOS
6.10
6.10.2
NON-IOS
6.9
6.9.2

Defect Information

Defect ID Headline
CSCvj49222 Cognitive Threat Analytics migrating to AWS Cloud

Problem Description

Cisco Cognitive Threat Analytics (CTA) will be migrated to a new location, which results in new URLs and IP addresses for access and use of the service.

Background

In order to help ensure future flexibility and performance, Cisco CTA will be migrated to the Amazon Web Services (AWS) Cloud.

The migration will take place in two phases:

  • The first phase covers the migration of the CTA Landing Page, CTA Portal, API Services, and Trusted Automated eXchange of Indicator Information (TAXII) service.
  • The second phase covers the migration of the data ingest services.

This Field Notice covers the changes related to the first phase of the migration only. A subsequent Field Notice that covers the second phase of the migration will be published at a later date.

Switchover Details

The switchover is scheduled to take place on Monday, August 20 2018 7:00 - 9:00 a.m. CEST (Sunday, August 19 10:00 p.m. - midnight Pacific).

During the switchover, there will be a two hour maintenance window required to resync data from the old data center to the AWS data center during which the CTA user interface, Structured Threat Information eXpression (STIX)/TAXII services, and integration services will be unavailable. Data ingest will continue to accept customer telemetry, but no new devices can be provisioned during the maintenance break.

Problem Symptom

As a consequence of the migration, you might need to perform changes in order to use the service unaffected.

Failure to perform the needed changes will not result in loss of data analytics, but might result in loss of access to the CTA portal as well as a stop of import into your security information and event management (SIEM) solution should you use one.

Workaround/Solution

The current URLs will stay unchanged, but point to new IP addresses after migration. In order to continue to use the service after the completed switchover, you should make these changes:

  1. If you have access control lists (ACLs) in place in your firewall that limit outbound access, and these ACLs are IP address-based, you must add the new IP addresses/ranges. Allow both AWS Elastic IP (EIP) addresses and Cisco IP addresses listed in the table.
  2. If you use the API offered by Cisco CTA to export your security data into your own SIEM solution, and you reference Cisco's API by IP address and not by URL, Cisco recommends that you change your setting in your SIEM solution to use the URL.

    If you cannot use the URL in your SIEM solution, you can change your settings to point to one of the IP addresses, but in that case Cisco cannot guarantee the service availability. If you need the service to always be available you need to use the URL, as high availability will be implemented with Domain Name System (DNS).

Refer to the tables for the new as well as the current URLs and IP addresses.

Current URLs and IP Addresses

Service Description Service URL Service IP
CTA public landing page https://cognitive.cisco.com/ 108.171.128.81
CTA login page https://td.cloudsec.sco.cisco.com/CWSP/ 108.171.128.81
CTA TAXII service https://taxii.cloudsec.sco.cisco.com 108.171.128.84

 

New URLs and IP Addresses

Service Description Service URL Service IP

CTA public landing page

https://cta.eu.amp.cisco.com/

https://cognitive.cisco.com/ (alias)

AWS EIPs:

  • 34.242.41.248
  • 34.242.94.137
  • 34.251.54.105

Cisco IPs:

  • 146.112.59.0/24
  • 208.69.38.0/24

CTA login page

https://cta.eu.amp.cisco.com/

https://td.cloudsec.sco.cisco.com/CWSP/ (alias)

AWS EIPs:

  • 34.242.41.248
  • 34.242.94.137
  • 34.251.54.105

Cisco IPs:

  • 146.112.59.0/24
  • 208.69.38.0/24

CTA TAXII service

https://cta.eu.amp.cisco.com/taxii

https://taxii.cloudsec.sco.cisco.com (alias)

AWS EIPs:

  • 34.242.41.248
  • 34.242.94.137
  • 34.251.54.105

Cisco IPs:

  • 146.112.59.0/24
  • 208.69.38.0/24

For More Information

If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:

Receive Email Notification For New Field Notices

Cisco Notification Service—Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products