Cloud SWG: Reminder of GFRPA Decommission

The maintenance is now complete. Thanks for your patience.

The scheduled maintenance is now underway. We'll keep you updated on our progress.

The upgrade of the Paris Localization Zone (GFRPA) to a compute point-of-presence (POP) in Paris (GFRVE), was performed on September 25, 2024. This is a reminder that the decommission of GFRPA is scheduled for October 23, 2024. The change will start at 19:00 UTC and will last for two hours.

As announced in August 2024, this upgrade requires some IP changes, please carefully review the information below to avoid disruption of service.

Ingress IP Addresses:

• 199.116.172.1 - NEW September 25, 2024 (GFRVE)
• 46.235.153.164 - TO BE RETIRED October 23, 2024 (existing GFRPA ingress IP address)

Egress IP Addresses:

• 199.116.172.0/25 - NEW September 25, 2024 (GFRVE)
• 46.235.153.0/24 - TO BE RETIRED October 23, 2024 (existing GFRPA egress IP range)
• 168.149.163.0/24 - TO BE RETIRED October 23, 2024 (existing GFRPA egress IP range)
• 148.64.19.0/24 - TO BE RETIRED October 23, 2024 (existing GFRPA egress IP range)

Required Action

Prior to the General Availability Date: September 25, 2024

• Firewall rules regulating connectivity to/from your network to Cloud SWG should be adjusted to allow traffic to pass to the NEW IP networks listed above.
• Third party applications that regulate connections by source IP address should be updated to accept connections from the NEW egress IP networks listed above to ensure traffic proxied through Cloud SWG can reach the application.
• Auth Connector must be able to communicate with all egress ranges listed above on TCP 443, where applicable.

Failure to make these changes could prevent users from connecting to Cloud SWG, accessing third party web applications, or authenticating against the service using the Auth Connector (where applicable).

• IPsec: Customers must update their tunnel configurations to point to the NEW ingress IP address before October 23, 2024. This change can be made after September 25, 2024.
• WSS Agent, Symantec Enterprise Agent: Traffic from all supported agents will be automatically directed to the new POP where appropriate. No action is required.
• Explicit proxy, proxy forwarding: Customers directing traffic to proxy.threatpulse.net will be automatically redirected to the new POP. No customer action is required.
• Regardless of the connection method, any configuration pointing to a specific POP hostname or IP address (not recommended) must be manually switched to the new POP prior to the decommissioning date to avoid an outage.

Please visit this KB article for a full list of IP networks used by Cloud SWG.

Technical Support

Experiencing issues? Contact technical support by visiting here.

For service status and maintenance updates visit and subscribe to Broadcom Service Status.