Introduction
This document describes an announcement about adding the Cisco Umbrella Secure Internet Gateway (SIG) IP address range 151.186.0.0/16.
Prerequisites
Requirements
There are no specific requirements for this document.
Components Used
The information in this document is based on Cisco Umbrella Secure Internet Gateway (SIG)
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
Important: Action Required
When your traffic leaves an Umbrella edge data center, the source (or “egress”) IP addresses is chosen from a range of Umbrella address blocks. As Umbrella continues to extend and improve the Umbrella service, Umbrella added this IP address range:
- SIG IP address range 151.186.0.0/16
Impact
You can be required to inform providers of services you access through Umbrella of this new IP address range.
Some service providers require prior knowledge of the source IP address ranges used to access their services. If you are using such services, you must inform your providers of this new range (151.186.0.0/16) to ensure uninterrupted access to your services through Umbrella.
The 151.186.0.0/16 range is being implemented first in the Tokyo edge data center. Initially, a limited amount of traffic egresses from this IP address range. 155.190.0.0/16 continues to be the primary egress range for Umbrella, with 146.112.0.0/16 and 151.186.0.0/16 used only in rare circumstances.
Reserved IP is available for customers that require a fixed egress IP address that is not shared with other Umbrella customers.
Update (April 19th):
SWG servers in many of our new data centers use 151.186.0.0/16 for ingress. That is, proxy.sig.umbrella.com resolves to IPs in the 151.186.0.0/16 range. The first two data centers with this change are Tokyo 2 and Mumbai 2.
If you limit outbound connectivity on your network and endpoints, please be sure to add an allow rule for 151.186.0.0/16. The full list of firewall recommendations for SWG is availablehere.
Update (February 14th):
The new IP address range cannot be used for internet-facing connections in the Tokyo edge data center. The new range can be used for internet-facing connections initially in upcoming expansion data centers (Tokyo #2 and Mumbai #2) in the coming months, and for other new and expanded data centers going forward.
Feedback