Web Security Service Announcement - Capacity Expansion Tokyo (GJPTK) IP network

Required Action If end user connectivity to WSS is regulated by stringent firewall rules, those firewall rules should be adjusted to allow traffic to pass to and from the egress IP network listed above prior to the maintenance window. In addition, any third party application provider who regulates connections by source IP should be updated to accept connections from the egress IP network listed above to ensure WSS traffic passes unencumbered.

Explicit over IPsec (“trans-proxy”): The underlying IP address for ep.threatpulse.net will NOT change as part of this migration.

The access methods below all require firewall changes. The following use case demonstrates why these access methods require firewall changes:

Use case: Group-based policies and authentication: Even in the case where users may be roaming and not coming from the same location, group based policies could fail if the auth connector cannot communicate with these new egress IP addresses.

It is imperative that the firewall whitelist access to these egress IP addresses to avoid problems.

Unified Agent and WSS Agent: Firewall rules will need to be updated as described above to allow the new egress addresses.

Symantec Endpoint Protection Web Traffic Redirector (SEP-WTR): The underlying IP address for sep-wtr.threatpulse.net will not change as part of this migration. Firewall rules will need to be updated as described above to allow the new egress addresses.

Explicit proxy and proxy forwarding: The underlying IP address for proxy.threatpulse.net will not change as a part of this migration. Firewall rules will need to be updated as described above to allow the new egress addresses.

Questions? If you have further questions regarding this announcement, contact Technical Support. Support information is located at: https://support.broadcom.com/security

For real time updates and status visit and subscribe to Broadcom Service Status: https://wss.status.broadcom.com

Schedule