CQG Connectivity Update: Amazon CloudFront
CQG is updating how CQG Desktop / OneCQG, CAST 2, and MY are delivered over the internet by moving these services behind Amazon CloudFront.
The website addresses you normally use will remain the same. This page provides test links and network information to help you prepare.
Services and Test Links
Service | Usual Address (Moving to CloudFront) | Test Address |
|---|---|---|
CQG Desktop / OneCQG | ||
CAST 2 | ||
MY |
The test addresses are provided for connectivity checks. Continue using your usual addresses for day-to-day access.
How to Test
- Open the relevant test link from the computer and network you normally use to access CQG.
- Confirm that the page loads without a connection error, certificate warning, or network block.
- If you use a corporate VPN or more than one work network, repeat the check through those connections.
Loading the page confirms initial connectivity. It does not by itself verify sign-in or every application function.
If a test link does not load, share the URL and error message with your IT team or your usual CQG support representative. Include the time of the test, your time zone, and whether you were connected through a VPN.
Information for IT and Network Administrators
The move to CloudFront may require updates where access is restricted by destination IP address, hostname, firewall policy, or web proxy rules.
Review outbound HTTPS access on TCP port 443 to the production and test hostnames listed above. Where supported by your security policy and network equipment, use hostname-based rules for these CQG endpoints.
These hostnames identify the entry points covered by this change; they are not a complete list of application dependencies. Retain existing CQG connectivity rules unless CQG advises otherwise.
CloudFront IP Address Ranges
Amazon maintains the authoritative information here:
- Amazon CloudFront: Edge Server Locations and IP Address Ranges
- Current CloudFront IP Ranges
- AWS IP Ranges JSON File
For IP-based rules, follow Amazon's guidance for CloudFront edge ranges. In the AWS JSON file, Amazon identifies these using:
service: CLOUDFRONT
and
region: GLOBAL
Review IPv4 and IPv6 entries as applicable to your network.
The CloudFront origin-facing managed prefix lists serve a different purpose: allowing CloudFront to reach servers hosting content. They are not the appropriate lists for customer connections to CloudFront. See Amazon's explanation of edge ranges and origin-facing prefix lists .
CloudFront ranges are shared across AWS customers; an IP allowlist alone does not limit access to CQG.
Keeping IP-Based Rules Current
AWS IP ranges can change. If your organization maintains IP-based rules, establish a process to keep them current. Amazon provides AWS IP Address Range Change Notifications .
Need Assistance?
Contact your usual CQG support representative with the affected service, test URL, error message, and test time, including your time zone.