IP Addresses and Ranges

Inbound IP address access list

The addition of more PoPs results in more IP addresses. If you restrict access in your firewalls, it is important that you add the new IP addresses to the access list. Adding the new IP addresses to the access list makes sure that access isn't blocked when the new PoP goes live. 
To make sure that the endpoints can fully use the GRM for Secure Web Gateway traffic routing to the best available PoP, you must allow the inbound IP addresses. The inbound IP addresses are listed in the Inbound column of the table below.

• If you restrict access in your firewalls, you need to allow all IP addresses from the list below. This action makes sure that you're not blocking access or imposing restrictions on traffic to a specific region or location. This method allows for a smooth failover and better load-balancing of the cloud services.
• Using an IP address instead of a host name for the browser proxy settings isn't supported. For Secure Web Gateway to process user traffic, you must configure the browser proxy settings or Skyhigh Client Proxy (SCP) policy settings to use the GRM host name as a proxy:

Syntax: c<customer-ID>.wgcs.skyhigh.cloud  — Each customer uses their own customer ID.

Example: c12345678.wgcs.skyhigh.cloud

Outbound IP address access list

For some business-to-business applications, or for some destination services with source IP address restrictions, you might need to provide your business partner with IP addresses to allow connectivity. The IP addresses are listed below in the Outbound column.

To download the latest IP address list, use the direct link provided below, or go to the Skyhigh_Security_Service_Status/Service_Status site and select Setup, IP-Addresses/Ranges. This site also provides the PoP status, recent incidents, and scheduled maintenance information for Secure Web Gateway:

• https://status.skyhighsecurity.com/swg/ip_addresses.csv
• https://status.skyhighsecurity.com/swg/ip_addresses.json