Working with the Cato System Range

By default, Cato reserves the private IP prefix as the internal System Range of your account. This range must be allowed within the network, IPs in the System Range allow for Cato's features to work properly in your account.

This article includes mapping of IPs in the System Range and their purpose, refer to this mapping to identify System Range hosts within your network traffic.

If you want to monitor the the availability of the default Cato System Range, you can set up a continuous ping with ICMP to (for a customized range, use X.Y.Z.1 such as

Changing The System Range

In case the default reserved IP prefix does not fit your environment's network design, you can modify the System Range to a custom range of your choice.

If you need to modify the System Range, please reach out to Cato Support.

Reserved IPs in The System Range

Reserved IPs of the System Range can be identified in multiple interfaces such as PCAPs, routing tables, the Socket WebUI, the Cato Client, and more.

The following table lists known internal hosts and their functions. When you change the System Range to a custom IP prefix the mapping of hosts changes as well, this mapping can be found in the Custom Range IP Address column below.

Additional private IPs (not included in this table) are used for internal purposes. Please reach out to Cato Support if you have questions on IPs within the System Range that are not listed below.



Default Range IP Address

Custom Range IP Address


Default DNS server


User Awareness Client

Source for WMI queries sent to Directory Services



Note: It's advised to flush the DHCP cache of your connected devices once the System Range is modified.

Was this article helpful?

0 out of 0 found this helpful

1 comment

  • Comment author
    Yaakov Simon

    Removed Local Gateway as a reserved IP for the System Range as it is no longer relevant.

Add your comment