Internet access requirements for managed devices
Internet access to the listed resources supports essential operations and configured features in your deployment.
For deployments behind a network barrier—like an edge firewall—make sure you allow traffic on the required ports to the listed resources.
Internet resources accessed by managed devices
This table identifies the internet resources that managed devices access.
|
Feature |
Reason |
HA/Clustering |
Port |
Resource |
|---|---|---|---|---|
|
Required for initial setup |
||||
|
DNS |
DNS |
All units communicate with the DNS server. |
53/tcp 53/udp |
Default OpenDNS servers: 208.67.222.222 and 208.67.220.220 2620:119:35::35 |
| NTP |
Synchronize time. Not supported with a proxy server. |
All units communicate with the NTP server. |
123/udp |
Default NTP servers: 0.sourcefire.pool.ntp.org 1.sourcefire.pool.ntp.org 2.sourcefire.pool.ntp.org 3.sourcefire.pool.ntp.org |
|
Required for general operations |
||||
|
CA certificate bundles |
Managed devices query for new CA certificates daily at a system-defined time. The local CA bundle contains certificates for accessing several Cisco services. |
Each unit downloads its own certificates. |
443/tcp |
cisco.com/security/pki |
|
Cisco Support Diagnostics |
Accepts authorized requests and transmits usage information and statistics. |
All units communicate. |
443/tcp |
api-sse.cisco.com:8989 |
|
Required for specific configurations or features |
||||
|
Malware Defense |
Submit files for dynamic analysis. |
All units submit files. |
443/tcp |
fmc.api.threatgrid.com fmc.api.threatgrid.eu |
|
Upgrades |
Download upgrades directly to managed devices. Tests the connection once a week. |
Upgrade packages do not sync. Each unit must get its own. |
443/tcp |
cdo-ftd-images.s3-us-west-2.amazonaws.com |
|
Umbrella DNS |
Direct DNS queries to Cisco Umbrella for validation and policy enforcement. |
All units communicate. |
443/tcp |
api.opendns.com |
Security Cloud Control regional IP addresses
To onboard and manage devices using zero-touch provisioning, allow inbound access on port 443 (or whichever port you configured for device management) from the Security Cloud Control IP addresses in your region.
|
Security Cloud Control region |
IP addresses |
|---|---|
|
Asia-Pacific-Japan (APJ) |
54.199.195.111 52.199.243.0 |
|
Australia (AUS) |
13.55.73.159 13.238.226.118 |
|
Europe, the Middle East, or Africa (EMEA) |
35.157.12.126 35.157.12.15 |
|
India (IN) |
35.154.115.175 13.201.213.99 |
|
United States (US) |
52.34.234.2 52.36.70.147 |