[Action Required] Cloud SWG Localization Zones Retirement Announcement: Abu Dhabi (GAEAD)

The Localization Zone for Abu Dhabi, UAE (GAEAD), will be retired on September 23rd, 2026. In order to improve performance, we are asking customers currently using GAEAD to connect to the Cloud SWG VPOP in Dubai, UAE (GAEDX), hosted in Damman, (GSADA).

Carefully review the information below to avoid disruption of service.

Retirement Date: September 23rd, 2026

Ingress IP address

• 109.68.63.164 (GSADA) - MOVE YOUR IPSec TUNNELS TO THIS LOCATION before September 23rd, 2026.

Egress IP ranges

• 199.247.33.0/26 (GAEAD) - TO BE RETIRED on September 23, 2026

PLEASE ENSURE ACCESS FROM THE RANGES BELOW IS ALLOWED before September 23, 2026:

• 148.64.14.16/28 (GAEDX)
• 34.166.201.32/28 (GSADA)
• 109.68.63.0/24 (GSADA)
• 2604:b040:13:1600::/80 (GSADA)

Required Action prior to September 23rd

• Firewall rules regulating connectivity from your network to Cloud SWG should be adjusted to allow traffic to the ingress IP networks listed above.
• Third party applications that regulate connections by source IP address should be updated to accept connections from the egress IP networks listed above to ensure traffic proxied through Cloud SWG can reach the applications.

Failure to make these changes could prevent users from connecting to Cloud SWG, accessing third party web applications, or authenticating against the service using the Auth Connector (where applicable).

• IPsec: Customers must update their tunnel configurations to point to the GSADA ingress IP address before September 23rd, 2026. This change can be made immediately.
• WSS Agent, Symantec Enterprise Agent: Agent traffic will be automatically redirected to the replacement POP. No customer action is required.

• Explicit proxy and proxy forwarding: Customers directing traffic to proxy.threatpulse.net or ae.threatpulse.net will be automatically redirected to the replacement POP. Customers directing traffic to gaead2-vip[1-6].threatpulse.net will need to change to gaedx1-vip[1-6].threatpulse.net. Additionally, customers directing traffic to gaead2-backup-vip[1-6].threatpulse.net will need to change to gaedx1-backup-vip[1-6].threatpulse.net.

• Regardless of connection method, any configuration pointing to a specific POP hostname or IP address (not recommended) must be manually switched to the replacement POP prior to the decommissioning date to avoid an outage.

Please visit this KB article for a full list of IP networks used by Cloud SWG.

Technical Support

Experiencing issues? Contact technical support by visiting: https://support.broadcom.com/security.

For service status and maintenance updates visit and subscribe to Broadcom Service Status.