Advanced IP Defense relies on continuous communication between the firewall and Advanced IP Defense to deliver real-time threat detection. The firewall sends two types of messages to the cloud: copies of DNS response IP-TTL pairs that Advanced IP Defense uses to build a per-tenant DNS state table, and Advanced IP Defense lookup requests that query IP attributes and direct-to-IP status for a given destination. Because these exchanges happen inline with traffic processing, connectivity reliability directly affects detection accuracy and user experience.

On a cache miss, the firewall allows the initial session to pass (fail-open) and asynchronously queries Advanced IP Defense for a verdict. The firewall does not hold or buffer packets while waiting for the cloud response. Once the verdict is returned, the local cache is populated and the policy is strictly enforced on all subsequent sessions matching that IP. If Advanced IP Defense becomes unreachable, the firewall reverts to fail-open to prevent a network outage.

The firewall caches IP attributes locally to reduce the volume of cloud lookups. The firewall only queries Advanced IP Defense on a cache miss—when it encounters an IP that isn't in the local cache or whose cached attributes have expired.