Advanced IP Defense relies on continuous communication between the firewall and the cloud service to deliver real-time threat detection. The firewall sends two types of messages to the cloud: copies of DNS response IP-TTL pairs that the cloud service uses to build a per-tenant DNS state table, and Advanced IP Defense lookup requests that query IP attributes and direct-to-IP status for a given destination. Because these exchanges happen inline with traffic processing, connectivity latency and reliability directly affect detection accuracy and user experience.

The cloud lookup timeout controls how long the firewall waits for an attribute response before allowing traffic to pass. If the cloud lookup times out, the firewall fails open to preserve business continuity -- it allows the traffic rather than blocking it. A lower timeout reduces latency for end users but increases the chance that the firewall misses an attribute check. A higher timeout gives the cloud service more time to respond but can slow traffic processing. You should tune this value based on the network latency between your firewall and the nearest Advanced IP Defense cloud endpoint.

The firewall caches IP attributes locally to reduce the volume of cloud lookups. Short-lived attributes such as malware C2 indicators and scanning activity have a cache TTL of 300 seconds (5 minutes), while stable attributes such as netblock owner and cloud provider classifications have a cache TTL of 86,400 seconds (24 hours). The firewall only queries the cloud service on a cache miss -- when it encounters an IP that isn't in the local cache or whose cached attributes have expired. An optional Bloom filter (negative cache) can further reduce lookups by informing the firewall that the cloud service has no attributes for certain IPs.

The firewall also periodically pulls updated allowlist files from a cloud storage bucket to pre-populate known-safe entries locally. This pull occurs at regular intervals and delivers two per-tenant files: one for the Advanced IP Defense allowlist and one for the no-DNS allowlist. If the firewall can't reach the cloud storage endpoint, it continues to use the most recent cached version of the allowlists. When the firewall reaches its maximum DNS cache capacity, it fails open on direct-to-IP detection and doesn't take action on no-DNS traffic until capacity is available.