To: CSL Network / Firewall Team Cc: Sivabalan Akilandam (created the existing allow_eugene_cloud_url rule) Subject: Panorama — add 3 destination FQDNs to allow_eugene_cloud_url (AWUSEA1-Egress) to unblock Eugene live sources Hi team, Thank you for the egress rule you added on 01-Sep — **allow_eugene_cloud_url** (device group **AWUSEA1-Egress**, post-rules). It works: traffic from 10.88.204.26 to 34.107.134.59 (clinicaltrials.gov / NCBI eutils) now completes cleanly (your traffic log, 09/01 22:13, session-end = tcp-fin, data returned). The Eugene application still cannot reach three external sources it needs, and we've traced why. This is a small, precise ask. WHAT'S HAPPENING ---------------- Requests to these sites are ALLOWED by policy but the session is being **reset by a security profile** — your 08/19 traffic log shows action = allow, rule = allow_internet_access_srvc, SESSION END REASON = **threat** for 193.62.193.80 (www.ebi.ac.uk). So it is not a port/route/deny issue; it's the threat profile on the broad internet rule resetting the connection. The dedicated allow_eugene_cloud_url rule does NOT reset (that's why 34.107.134.59 works) — it just doesn't yet list these destinations. THE ASK — add 3 FQDN destination objects to allow_eugene_cloud_url ------------------------------------------------------------------ Please add the following as **FQDN address objects** (not IP objects — these are CDN-fronted and their IPs rotate) to the Destination of allow_eugene_cloud_url, and keep the rule with **no session-resetting threat profile** (as it is today): 1. www.ebi.ac.uk Europe PMC (biomedical literature) 2. www.ncbi.nlm.nih.gov PubMed (eutils redirects here for content) 3. efts.sec.gov SEC EDGAR (corporate filings) No source change is required: the application egresses via 10.88.204.26, which is already the permitted source on this rule. Then Commit and Push to AWUSEA1-Egress. OPTIONAL (lets us retire a temporary workaround) ------------------------------------------------ The Eugene agent actually runs on ECS in 10.88.203.0/24, and today we route its internet traffic through a forward proxy on 10.88.204.26 to satisfy the single-host source scope. If you'd also add source object **net_10.88.203.0_24_legacy_aws_vpc_us_region** to allow_eugene_cloud_url, we can remove that proxy and have the app egress directly. This is a nice-to-have, not required for the fix above. WHY IT MATTERS -------------- These three sources are core to the product: literature search (Europe PMC / PubMed) and IP/filing intelligence (SEC). Without them the corresponding features return empty results to users even though the app and the graph are healthy. VERIFICATION ------------ Once pushed, we can confirm from the application subnet in ~2 minutes and will share the result. For your side, a traffic-log filter of `( addr.src in 10.88.204.26 ) and ( rule eq allow_eugene_cloud_url )` should show tcp-fin sessions to all three FQDNs. Reference (AWS side, for context): - App subnet (ECS): 10.88.203.0/24 vpc-070f89d8985cafbb6 - Permitted egress host: 10.88.204.26 vpc-0b055f51ee4dbec56 - Already working dest: 34.107.134.59 (clinicaltrials.gov, eutils) Happy to hop on a quick call if useful. Thanks again for the earlier fix. Best regards, Rajesh Kumar Gupta Eugene / CSL Atlas