Cloud SWG Announcement: Cross-Regional Failover Support Change August 25, 2025

In the event of excessive traffic load due to maintenance activities or a GCP regional outage, traffic to a Cloud SWG site can fail over to the closest neighboring site. On August 25, 2025, Broadcom will enable a new improved cross-regional failover support. This means that every region has a backup region that is built to scale to cover all of the existing traffic and all traffic from another region. With this, Cloud SWG can lose any region, potentially multiple regions, and continue to offer the same level of service.

To ensure that your traffic fails over to the optimal region, configure your deployment according to the recommendations provided below for each access method. Note that with Cloud SWG agent (WSSA, ESA) failover is automatic and does not require any configuration changes.

Important notes:

• Each Cloud SWG site provides redundancy within a Google Cloud (GCP) region, where a cluster of multiple datapods are spread across three availability zones. Redundancy is also supported across GCP regions.
• Each Cloud SWG (primary) site and its assigned failover site are in different GCP regions.
• Each failover site has the capacity to support all traffic (WSS Agent, IPsec firewalls, proxy forwarding, and explicit proxy) from its largest neighboring site (the primary site).
• Each Cloud SWG site auto-scales when higher loads are observed due to failover traffic from its neighboring site.

Required Action

To ensure correct failover for fixed locations, make sure to review the configuration recommendations and make updates accordingly, prior to August 25, 2025:

1. Configure the redundant traffic to newly designated failover site, which can be found in the KB at https://knowledge.broadcom.com/external/article/400758
2. If the secondary/failover sites are different that the current ones, make sure to update any firewall rules regulating connectivity with Cloud SWG to allow traffic to pass to/from the failover IP network for IPSec traffic and the new hostnames for Proxy Forwarding. The IP network information for each location can be found at https://knowledge.broadcom.com/external/article/167174/data-center-ip-addresses-for-web-securit.html
3. Third party applications that regulate connections by source IP address should be updated to accept connections from the failover IP networks to ensure traffic proxied through Cloud SWG can reach the applications.

In case a failover occurs, failure to make these changes could prevent users from connecting to Cloud SWG, accessing third party web applications, or authenticating against the service using the Auth Connector (where applicable).

Please review important details on configuration recommendation per access method (IPsec, Proxy Forwarding and Explicit), in the Fixed Cloud SWG Location Method Technical Documentation at https://techdocs.broadcom.com/us/en/symantec-security-software/web-and-network-security/cloud-swg/help/conn-matrix/adm_addlocation_st/failover-support-for-fixed-locations.html

Please visit this KB article for a full list of IP networks used by WSS: https://knowledge.broadcom.com/external/article/167174

Technical Support

Experiencing issues? Contact technical support by visiting: https://support.broadcom.com/security. For service status and maintenance updates visit and subscribe to Broadcom Service Status: https://wss.status.broadcom.com.