Allowing communication between the FortiDLP Agent and FortiDLP Cloud

Every FortiDLP Agent requires a direct connection to the FortiDLP Cloud to report real-time data and receive configuration updates. FortiDLP Agents make this connection using one of the following DNS entries depending on the cluster region:

• US: edge.27d0b831.reveal.nextdlp.com:443
• EU: edge.4bfc9a65.reveal.nextdlp.com:443

The FortiDLP Agent uses mutually-authenticated certificates to secure connections with the FortiDLP Cloud. The trust relationship between the FortiDLP Agent and FortiDLP Cloud is managed by FortiDLP and established during Agent enrollment. The Agent rejects connection attempts to devices that do not present the correct certificates, such as transparent proxies.

If you enable automatic upgrades, the Agent will also contact updates.qush.com:443 using HTTPS to download software updates. For more on this, see Upgrading the FortiDLP Agent.

To prevent connectivity issues, you must ensure all proxies and other terminating/redirection services have explicit exemptions in place to allow communications with the FortiDLP Cloud. For some organizations, this will only require the addition of FortiDLP Cloud IP addresses to allowlists. For others, it may be necessary to exempt certain certificate subject names to allow transparent passthrough. While the FortiDLP Agent uses the FQDN to resolve the IP address of the FortiDLP Cloud, this is not the subject name of the certificates that gets used for all TLS connections. However, the Server Name Indication (SNI) is always set to either enroll.edge.jazz, circuit.edge.jazz, v2.circuit.edge.jazz, or http.edge.jazz.

Before you deploy the FortiDLP Agent, either manually or via a fleet management tool, you should configure your network firewall rules to allow access to the following.

US customer allowlist

• edge.27d0b831.reveal.nextdlp.com
• edge.27d0b831.reveal.qush.com
• edge.27d0b831.reveal.avasecurity.com
• edge.27d0b831.reveal.ava.uk
• edge.27d0b831.cloud.jazznetworks.com
• updates.qush.com
• updates.nextdlp.com
• uploads.us0.reveal.nextdlp.com
• 34.36.139.49
• 35.232.224.35
• enroll.edge.jazz
• circuit.edge.jazz
• v2.circuit.edge.jazz
• *.circuit.edge.jazz
• http.edge.jazz

EU customer allowlist

• edge.4bfc9a65.reveal.nextdlp.com
• edge.4bfc9a65.reveal.qush.com
• edge.4bfc9a65.reveal.avasecurity.com
• edge.4bfc9a65.reveal.ava.uk
• edge.4bfc9a65.cloud.jazznetworks.com
• updates.qush.com
• updates.nextdlp.com
• uploads.eu0.reveal.nextdlp.com
• 34.160.252.90
• 130.211.100.13
• enroll.edge.jazz
• circuit.edge.jazz
• v2.circuit.edge.jazz
• *.circuit.edge.jazz
• http.edge.jazz

Fortinet aims to avoid altering FortiDLP Cloud IP addresses, but we cannot guarantee this indefinitely. For this reason, we recommend routinely checking the IP addresses and the Europe/USA edge addresses using nslookup or dig to keep your firewall rules up to date. We reserve the right to add additional SNIs in the future.

Browser extension and email add-in communications

If you will be using the FortiDLP Browser Extension for Firefox, you must also configure your firewall rules to allow access to https://firefox-extension.reveal.nextdlp.com, so that the extension is automatically updated.

Additionally, if you will be deploying the FortiDLP Email Add-in, your firewall rules should allow access to the:

• outlook-addin.reveal.nextdlp.com domain, and
• Agent's local web server (Outlook Proxy), 127.0.0.1:13243.

For more information, including troubleshooting steps, click here. If you would like to verify your configuration, contact Fortinet Support.