Allowlisting Processes and URLs for the Cato Client

Overview

To ensure that the Cato Client can communicate with required Cato services and avoid any impact on Client traffic, allowlist the processes and URLs listed in this article in third-party products and services (such as endpoint security products, firewalls, proxies, etc...).

For more information, see Preparing to Install the Cato Client.

Understanding Regional CMA Domains

Cato operates the Cato Management Application (CMA) in multiple AWS regions to support data sovereignty and residency requirements. Each Cato account is associated with a CMA region, which provides the control-plane services used to manage the account and communicate configuration and other service information to the Cato Client. For more information, see this article.

Some URLs required by the Client are global and are shared across all CMA regions. Other URLs are region-specific and use a domain associated with the account's CMA region. To simplify configuration, allowlist the global URLs and all the URLs listed for your CMA region. For example, sso.ias.catonetworks.com is a global URL, and auth.jp1.catonetworks.com is a local URL for the Japan CMA tenant.

Note: The CMA region does not determine which Cato Cloud PoPs the Client can connect to. By default, Clients can connect to available PoPs across the Cato Cloud independently of the account's CMA region.

Allowlisting for All Devices

This section lists URLs and processes that you need to allowlist based on the CMA region for your account.

Windows Operating Systems

The following section lists the processes and URLs for all security endpoint software and solutions for endpoints running Windows operating systems.

• CatoClient.exe

• winvpnclient.cli.exe

• login.microsoftonline.com

• CatoUpgradeHelper.exe

• CatoLogCollector.exe

• LogLevelSetup.exe

• CatoClient.exe.config

• wa_3rd_party_host_32.exe

• wa_3rd_party_host_64.exe

• coresvc.exe

• For accounts that use a third-party proxy (for both HTTP and HTTPS):

  • IP - 85.255.31.1

  • URL - sso.ias.catonetworks.com

    Note: This is only required when using the embedded browser

• msftconnecttest.com

DNS Relay for Windows Clients

These are the processes and URLs that you need to allowlist for local firewalls with deployments that use DNS relay.

• IP - 127.0.0.253

• The Cato Networks DNS service

• The DNS relay process dns-relay.exe

macOS Operating Systems

The following section lists the processes and URLs for all security endpoint software and solutions for endpoints running macOS.

• Exclude the following folder and all its contents:

  /Library/Application Support/CatoNetworks

• For accounts that use a third-party proxy (for both HTTP and HTTPS):

  • IP - 85.255.31.1

  • appleiphonecell.com

• For accounts that have CrowdStrike installed on devices:

  • /Library/Application\ Support/CatoNetworks/com.catonetworks.mac.CatoClient.helper

  • /Library/Application\ Support/CatoNetworks/CatoNetworksUserAgent

• For accounts that have SentinelOne installed on devices:

  • /Library/Application Support/CatoNetworks

• For Captive Portal detection:

  • 1.1.1.1

Article Changelog