Knowledge Center

IP addresses tend to change from time to time. McAfee therefore recommends the use of a fully qualified domain name (FQDN) that returns a list of active endpoints at the nearest Cloud Point of Presence (PoP).

Access to Global Threat Intelligence (GTI) is configured on port 443 using an FQDN so that a DNS lookup can return the nearest and most accurate IP address records at any given time. This returned result can be any of several IP addresses across the globe. Because the exact IP address is not known in advance, firewall administrators must open port 443 outbound globally. If the firewall does not support configuring an open port against a host name, or if organizational security policies do not allow it, a specific GTI IP address must be used.

GTI is hosted as a global cloud service, so hard coding an IP address could result in an outage for one of the following reasons:

So, the preferred configuration method is to configure access to the GTI servers to use port 443 to the FQDN.

NOTE: The FQDN depends on the product, which requires you to see the product documentation for your installed product.

Examples of some product FQDNs used with GTI

NOTE: This list is not intended to be comprehensive. See the product documentation for the most specific and up-to-date information.