Understand Allowed IPs in Firewalls for Secure Web Gateway

Available Languages

Download Options

  • PDF     (20.0 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (81.2 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (66.3 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:October 28, 2026
Document ID:224848

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Introduction

This document describes which IPs and domains are allowed in the firewalls for Secure Web Gateway (SWG).

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

The information in this document is based on SWG deployments with a PAC file or an AnyConnect client with SWG module. 

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background

If you are deploying Umbrella's Secure Web Gateway (SWG), Umbrella recommends allowing SWGs IP space to ensure traffic is allowed through their perimeter firewalls. This also applies to any web filtering appliances you have. 

For additional details, refer to the Cisco Umbrella SIG User Guide.

IP Addresses

Cisco Umbrella is an elastic cloud service, and its IP space is dynamic and constantly changing. If you are deploying Umbrella SWG, Umbrella recommends allowing these CIDRs on their perimeter firewalls to ensure they can connect to the Umbrella SWG service:

67.215.64.0/19
146.112.0.0/16
151.186.0.0/16
155.190.0.0/16
185.60.84.0/22
204.194.232.0/21
208.67.216.0/21
208.69.32.0/21

Traffic Profile:

  • Protocol = TCP
  • Ports = Outbound 80 and 443

Domains

Umbrella also recommends these domains are bypassed at the source to ensure all traffic is allowed:

isrg.trustid.ocsp.identrust.com
*.cisco.com
*.opendns.com
*.umbrella.com
*.okta.com
*.oktacdn.com
*.pingidentity.com
secure.aadcdn.microsoftonline-p.com

Additional details on Secure Access can be found:

Revision History

Revision Publish Date Comments
3.0
28-Oct-2026
Updated URLs
2.0
10-Sep-2025
Initial Release
1.0
10-Sep-2025
Initial Release
TAC Authored

Contributed by Cisco Engineers

  • Cisco Engineers
    Cisco TAC Engineers

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products