Technical Tip: The source IP addresses of the FortiDLP Cloud

Description

This article describes what the source IP addresses of the FortiDLP Cloud are.

Scope

FortiDLP.

Solution

In some cases, it is necessary for the FortiDLP infrastructure to make outbound connections to other devices, i.e. LDAP/directory services, Google & Microsoft integrations, or webhook receivers. 

In these cases, it may be necessary for the destination firewall to have whitelisted the source IP addresses of the FortiDLP infrastructure.

 
For on-premise installations, it is expected that customers will already know their external IP address(es), however, for any FortiDLP Cloud customers, there is a DNS record maintained that will list all the public IP addresses for any cloud infrastructure that may be connecting outbound.

The DNS record is source.fortidlp.forticloud.com.

 
To look up the list of IP addresses, it is recommended to use a tool such as nslookup:

Name: source.fortidlp.forticloud.com
Addresses: 34.76.211.231
34.129.96.85
34.166.123.215
34.18.94.42
34.187.158.126
34.27.163.71
35.203.35.167
34.86.228.166
34.79.6.69
35.188.172.194
34.124.242.220

Note that the IP addresses listed above may change over time. Make sure to run this request when configuring the firewalls to get up-to-date information.