Reference: Web Security Service Data Center Ingress IPs

Fixed-location connectivity require you to enter IP addresses of the nearest Web Security Service datacenter(s).

You also must add these IP addresses plus the WSS portal to your firewall's allowed outbound rules.

The WSS Operations team maintains the following Knowledge Base article.