I am sitting behind a firewall, in my case esp. ZScaler.  I am wondering, what the best way is to whitelist "
deb.debian.org" for package management.  Do I have to whitelist individually all mirror sites that back the CDN?  If so, is there an up-to-date list of the hosts backing "
deb.debian.org"? 
Offtopic: Do you know, whether services like ZScaler provide dedicated support for CDNs?