Understand Allowed IPs and Domains in Firewalls for Secure Web Gateway

Introduction

This document describes which IPs and domains can be allowed in customer firewalls for Secure Web Gateway (SWG).

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

The information in this document is based on SWG deployments with PAC file or AnyConnect client with SWG module. 

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Overview

If you are deploying Umbrella's Secure Web Gateway (SWG), Umbrella recommends allowing SWG's IP space to ensure traffic is allowed through their perimeter firewalls. This also applies to any web filtering appliances that the customers can have. 

IP Addresses

Cisco Umbrella is an elastic cloud service, and its IP space is dynamic and constantly changing. If you are deploying the Umbrella SWG product, Umbrella recommends allowing these CIDRs on their perimeter firewalls to ensure they can connect to the Umbrella SWG service:

67.215.64.0/19
146.112.0.0/16
151.186.0.0/16
155.190.0.0/16
185.60.84.0/22
204.194.232.0/21
208.67.216.0/21
208.69.32.0/21

Traffic profile:

• Protocol = TCP
• Ports = outbound 80 and 443

Domains

Umbrella also recommends  that these domains are bypassed at the source in order to ensure that all traffic is allowed:

isrg.trustid.ocsp.identrust.com
*.cisco.com
*.opendns.com
*.umbrella.com
*.okta.com
*.oktacdn.com
*.pingidentity.com
secure.aadcdn.microsoftonline-p.com