Network Requirements
If your hosts reach the internet through a default-deny egress firewall, this page lists every outbound destination CIQ Depot uses so you can allow-list them explicitly.
Allow-list by hostname rather than by IP address. See Why hostnames and not IP addresses below.
Required Endpoints
These are needed for the standard flow of registering the Depot Client, refreshing repository metadata, and downloading packages.
| Hostname | Port | Used for |
|---|---|---|
portal.ciq.com | 443 | Portal sign-in and access token issuance |
depot.ciq.com | 443 | Client registration, product listing, entitlement checks, container image pulls |
cdn.depot.prod.azure.ciq.com | 443 | Repository metadata and package downloads |
cdn.depot.prod.azure.ciq.com is the stable, non-regional hostname for repository content. Target it rather than a region-specific hostname: it serves the same content regardless of which region is serving you, and it does not change as CIQ adds capacity.
AWS Content Host
Some repository configurations on AWS fetch content from a separate stable, non-regional hostname. Allow-list it only if the baseurl lines in your files under /etc/yum.repos.d/ reference it.
| Hostname | Port | Used for |
|---|---|---|
cdn.rlc.depot.prod.aws.ciq.com | 443 | Repository metadata and package downloads, for configurations that reference it |
Optional Endpoints
Add these only if you use the corresponding access method.
| Hostname | Port | Used for |
|---|---|---|
rsync.depot.ciq.com | 873 | Mirroring repositories over rsync. See the Rsync Guide |
The Depot Client itself never contacts rsync.depot.ciq.com.
Endpoints Seen Only on First Use
These do not appear in steady-state traffic, so a packet capture of a working system will not reveal them. They are still required.
| Hostname | Port | Used for |
|---|---|---|
ciq.com | 443 | GPG key retrieval on the first package install from a CIQ repository |
dl.rockylinux.org | 443 | GPG key retrieval on the first package install from a Rocky Linux repository |
download-cc-rdu01.fedoraproject.org | 443 | GPG key retrieval on the first package install from an EPEL repository |
Whether a host contacts these depends on its repository configuration, not only on the OS major version. Some configurations reference GPG keys from the local filesystem under /etc/pki/rpm-gpg, and others fetch them by URL. To see which applies to your hosts, check the gpgkey lines in the files under /etc/yum.repos.d/: every https:// entry is a host to allow-list.
Certificate Validation Endpoints
Depending on how your TLS stack handles certificate revocation checking, your hosts may also make outbound requests to the certificate authorities that issue CIQ's certificates. These requests are not limited to first use: OCSP and CRL lookups can recur on later connections. Whether they happen at all is determined by your client configuration, not by Depot.
The hostnames below are the ones in use for CIQ's current certificates. They belong to the certificate authorities and can change when certificates are renewed, so treat this list as current rather than permanent.
| Hostname | Port | Used for |
|---|---|---|
cdp.geotrust.com | 80 | Certificate revocation and chain retrieval |
status.geotrust.com | 80 | Certificate revocation and chain retrieval |
cacerts.geotrust.com | 80 | Certificate revocation and chain retrieval |
yr2.c.lencr.org | 80 | Certificate revocation and chain retrieval |
yr2.i.lencr.org | 80 | Certificate revocation and chain retrieval |
Region-Specific Hostnames
Repository configurations generated before the non-regional hostname was introduced may reference a region-specific hostname in the form depot.<region>.prod.azure.ciq.com, such as depot.eastus.prod.azure.ciq.com. These resolve to the same endpoint and serve the same content.
If your hosts still carry an older configuration, either repoint baseurl at cdn.depot.prod.azure.ciq.com or allow-list the region-specific hostname alongside it. New configurations should use the non-regional hostname.
Region selection happens on the CIQ side and is not based on client geolocation or account configuration. There is no per-client pinning, and traffic can move between regions. This is why the non-regional hostname is the correct allow-list entry: the serving region can change without anything in your firewall rules changing.
Why Hostnames and Not IP Addresses
Repository content on cdn.depot.prod.azure.ciq.com is served through Azure Front Door. Its edge addresses belong to Microsoft and rotate without notice, so an IP-based allow-list will break. CIQ does not publish IP ranges for Depot.
If your firewall cannot match on hostname, use the AzureFrontDoor.Frontend Azure service tag for the content endpoint.
Telemetry and Instance Metadata
The Depot Client sends telemetry only to depot.ciq.com, which is already in the required list above, so it needs no additional allow-list entry. No telemetry is sent to third parties. The third-party hosts on this page are contacted only for GPG key and certificate retrieval, as described above.
Telemetry is enabled by default only for unauthenticated installations. Running depot login disables it.
On cloud virtual machines with telemetry active, the client also reads instance metadata. On AWS, Azure, and OCI it uses the link-local address 169.254.169.254; on Google Cloud it uses metadata.google.internal. The cloud platform answers these requests locally and the traffic never leaves the virtual machine, so there is nothing to allow-list for them.
Reducing Your Egress Surface
If maintaining outbound rules on every host is impractical, mirror the repositories you need to an internal host and point your systems at the mirror. Outbound access is then limited to a single host during a controlled sync window:
Verifying Connectivity
Confirm each required endpoint is reachable before troubleshooting further:
curl -I https://portal.ciq.com
curl -I https://depot.ciq.com
curl -I https://cdn.depot.prod.azure.ciq.com
If your configuration uses the AWS content host, check it as well:
curl -I https://cdn.rlc.depot.prod.aws.ciq.com
Check DNS resolution separately, since a blocked DNS lookup and a blocked connection present the same symptom:
nslookup cdn.depot.prod.azure.ciq.com
If an endpoint is unreachable after your firewall rules are in place, contact CIQ Support with the hostname, the port, and the error your client returned.