Management path requirements

Trellix appliances can download software updates (security content, system images, and guest images) from the Trellix Dynamic Threat Intelligence (DTI) network. With a two-way content license, the appliance can also upload threat intelligence information to the DTI network. The Central Management System appliance and standalone appliances have a direct connection to the DTI network. By default, managed appliances receive software updates from the DTI network though the Central Management System appliance.

The Central Management System appliance and standalone appliances use the ether1 port to communicate with the DTI network. Managed appliances use the ether1 port to communicate with the Central Management System appliance. The ether1 port on both the Central Management System appliance and the managed appliances requires a static IP address or reserved DHCP address and subnet mask.

Environments that restrict outbound access to certain IP addresses

If your security policy requires that you restrict outbound access to certain IP addresses, you cannot use the DTI network. Instead, point to staticcloud.fireeye.com for DTI updates, and allow access to the *incapdns.net domain.

If your appliance gets threat intelligence from the DTI cloud, you need to enable access to the Amazon Web Services (AWS) cloud for ATI communication. The intel context service is hosted in multiple AWS regions and resolves to multiple IP addresses based on geographic location.

To configure and access staticcloud.fireeye.com:

Enable CLI configuration mode.

hostname > enablehostname # configure terminal

Enter the following command from the appliance CLI:

hostname (config) # fenet dti source default DTI

Save your configuration.

hostname (config) # write mem

Add IP addresses as listed here to the firewall.

To allow access to *incapdns.net:

Add the block of IP addresses found here to the firewall.
Allow access to the *.incapdns.net domain at the proxy device.

To allow access to the AWS cloud for threat intelligence:

Go to https://dnschecker.org/#A/context.fireeye.com to determine the IP addresses for your location.
See the AWS IP address range documentation for information about whitelisting the IP addressses.

Domain-Based Proxy ACL Rules

If your configuration includes domain-based proxy ACL rules, allow access to *.fireeye.com.