Skip to main content

Check out Interactive Visual Stories to gain hands-on experience with the SSE product features. Click here.

Skyhigh Security

Configuring Global Routing Manager Country and Region Prefixes

The Global Routing Manager (GRM) intelligently routes traffic to the closest Enterprise Point of Presence (PoP). For example, if a user is in Italy, they're routed to the closest PoP in Europe, rather than to North America or Asia. If that same user travels to New York City, they're routed to the PoP in New York, unless restricted by administrative policy.

The GRM is a DNS-based load-balancing service that returns to the endpoint through the route to the closest PoP. It considers the following information:

  • Geo-location of the user/endpoint
  • DNS request IP address
  • PoP availability
  • Proxy DNS name

The precise geo-location is needed to achieve the best performance and provide localized internet content to greatly improve user experience. To achieve a good approximation of the geo-location of the user or endpoint, the IP address of the endpoint sending a DNS request to the GRM is essential. The IP address seen on the GRM is typically not the same as the client IP address of the HTTP request. Instead, it's the IP address of the DNS resolver that the endpoint uses.

Problem

If you use cloud DNS services, such as Google DNS or OpenDNS, the geo-location reported for an endpoint might not be the correct geo-location in which the endpoint is located. These cloud DNS services use outbound IP addresses that are geo-located within the United States. The same behavior applies to customers who manage their own centralized DNS infrastructure in a specific country or region. This behavior can also impact user experience while receiving webpages (content) in a foreign language.

There's no issue for customers who are using a decentralized DNS infrastructure.

 

Solution

When using cloud DNS services or centralized DNS infrastructure to enforce the correct geo-location, use special purpose prefixes for the country or region selection. The prefixes are hierarchically organized with continents at the top level, followed by regions, and then countries. Choose a prefix with the widest geographical area coverage because the prefix restricts dynamic load distribution and failover.

Use prefixes only when needed. Use of a prefix overrules the dynamic routing logic of GRM. When prefixes are used to enforce the selection of a specific geo-location, users might experience overall performance issues when traveling. An increase in network latency, dynamic failover, and load-balancing issues can occur.

Use a prefix for proxy settings to specify the preference for a PoP from a certain country or region:

  • Country-specific prefix: If the host name for a proxy includes a prefix for an individual country, the closest or best PoP within the country is selected.
  • Region-specific prefix: If the host name for a proxy includes a prefix for a larger region, the closest or best PoP within that region is selected.

Syntax:

Remarks:

  • The new domain skyhigh.cloud replaces mcafee-cloud.com, which will be retired by December 31, 2022.
  • The classic WGCS domain saasprotection.com will no longer be supported, as the corresponding product will reach End of Life by December 31, 2022.
     

Please refer to the following examples:

  • Using the country-specific region prefix for the United Kingdom for Skyhigh Security Service Edge:
    uk.c12345678.wgcs.skyhigh.cloud
     
  • Using the country-specific region prefix for the United Kingdom for WPS Hybrid customers using SCP:
    uk.c12345678.hybrid.skyhigh.cloud


CAUTION: Using an IP address instead of a host name for proxy settings isn't supported.

If no PoP is available in the country or region specified in the proxy host name, the preconfigured fallback is to use the closest PoP regardless of the country or region. (It's unlikely that no PoP is available.)

To use the nearest PoP from the selected country or region for the endpoint, use the following predefined set of prefixes (subdomains):

Continents/Regions Prefix
Africa africa
Asia asia
Europe eu
North America na
Pacific island countries pacific
Latin America ltam
Asia Pacific apac

 

NORTH AMERICA Prefix
Canada ca
North America East Coast na-east
North America West Coast na-west
USA East us-east
USA Midwest us-midwest
USA South us-south
USA West us-west

 

LATIN AMERICA Prefix
Argentina ar
Bolivia bo
Brazil br
Chile cl
Colombia co
Mexico mx
Paraguay py
Peru pe
Uruguay uy
Venezuela ve

 

EUROPE Prefix
Austria at
Belgium be
Croatia hr
Czech Republic cz
Denmark dk
Finland fi
France fr
Germany de
Greece gr
Hungary hu
Ireland ie
Italy it
Netherlands nl
Norway no
Poland pl
Portugal pt
Romania ro
Serbia rs
Slovakia sk
Slovenia si
Spain es
Sweden se
Switzerland ch
Turkey tr
United Kingdom uk

 

ASIA/PACIFIC Prefix
Asia asia
Pacific island countries pacific
Middle East / Israel il
Australia au
Australia East au-east
Australia West au-west
Hong Kong hk
India in
India North in-north
India West in-west
Japan jp
Korea kr
New Zealand nz
Philippines ph
Singapore sg
Taiwan tw
Thailand th
United Arab Emirates ae

 

AFRICA Prefix
South Africa za

The dashboard at the Skyhigh Security Service Status site provides key status information for WGCS. It includes data center status, recent incidents, and scheduled maintenance.

  • Was this article helpful?