The IP address for CDN URLs changes frequently, causing problems for IP-based firewalls.
Because of the changing nature of CDN nodes, there isn't a single IP address that the request comes from. If your firewall supports it, you could allow the CDN Scene7 domains.
If not, use Secure Test functionality. See the following for more information: