Strata Cloud Manager

1. Log in to Strata Cloud Manager.
2. Navigate to the Content-ID settings.

   Select ConfigurationNGFW and Prisma AccessNetwork & DeviceDevice Setup, select the Content-ID tab, and edit the Cloud Content Settings.
3. Enable Advanced Forwarding.

   If you manage Prisma Access through Strata Cloud Manager, you must contact Palo Alto Networks Support to enable a tenant-level feature flag before Advanced Forwarding becomes active. Enabling the setting in the Content Cloud Settings UI alone does not activate Advanced Forwarding for Prisma Access. This requirement does not apply to NGFWs.

   Switching from the legacy transport mode to Advanced Forwarding causes a momentary disruption to the cloud connection. It is recommended to commit this change during a maintenance window.
4. Configure the Advanced Forwarding settings.

   • Discovery Service Address—The address for the discovery service that dynamically assigns advanced service addresses to the NGFW based on its serial number, PAN-OS version, and geographic location (default: pae-discovery.hawkeye.services-edge.paloaltonetworks.com). By default, the discovery service address resolves to the closest regional IP address.
     Ensure the discovery service address is reachable from your network. If your network restricts outbound access, allow traffic to this address so the NGFW can query for its assigned advanced service addresses.
     • Discovery Service Address per Region
       • United States (Central)—usc1.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • United States (East)—use4.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • United States (West)—usw1.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Canada—ca.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Brazil—br.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Germany—de.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • United Kingdom—uk.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Netherlands—nl.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Switzerland—ch.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • France—fr.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Poland—pl.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Spain—es.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Italy—it.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Israel—il.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Qatar—qa.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Saudi Arabia—sa.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Singapore—sg.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Japan—jp.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Korea—kr.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Taiwan—tw.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Indonesia—id.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • India—in.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Australia—au.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • South Africa—za.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
   • Discovery Service Interval (seconds)—The interval, in seconds, between discovery service queries. The NGFW periodically queries the discovery service to refresh its assigned advanced service addresses (default is 14400 seconds).
   • Max Discovery Retry Count—The maximum number of times the NGFW retries a failed discovery service query.

     The NGFW retries failed discovery queries every 60 seconds up to the configured maximum retry count. Once exhausted, retries continue at 5 minute intervals until discovery is successful.
   • Enable Multi-FQDN Support—Enable the NGFW to use multiple advanced service address FQDNs simultaneously. When enabled, the discovery service can assign different FQDNs for different cloud analysis services, allowing the NGFW to distribute connections across multiple endpoints. Reserved for future use.
   • Override Discovered CHS Address—Enable this option to manually override the Config Hub Service (CHS) address assigned by the discovery service. When enabled, the NGFW uses the address specified in Config Hub Service (CHS) Address instead of the discovery-assigned endpoint. Reserved for future use.
   • Config Hub Service (CHS) Address—The address for the Config Hub Service (CHS) that the NGFW uses to store and retrieve configuration. Only configurable when Override Discovered CHS Address is enabled. Reserved for

     • CHS Address per Region
       The Configuration Hub Service is reserved for future use. These addresses are provided as a reference for proxy allowlist configuration.
       • United States (Central)—usc1.chs.hawkeye.services-edge.paloaltonetworks.com
       • United States (East)—use4.chs.hawkeye.services-edge.paloaltonetworks.com
       • United States (West)—usw1.chs.hawkeye.services-edge.paloaltonetworks.com
       • Canada—ca.chs.hawkeye.services-edge.paloaltonetworks.com
       • Brazil—br.chs.hawkeye.services-edge.paloaltonetworks.com
       • Germany—de.chs.hawkeye.services-edge.paloaltonetworks.com
       • United Kingdom—uk.chs.hawkeye.services-edge.paloaltonetworks.com
       • Netherlands—nl.chs.hawkeye.services-edge.paloaltonetworks.com
       • Switzerland—ch.chs.hawkeye.services-edge.paloaltonetworks.com
       • France—fr.chs.hawkeye.services-edge.paloaltonetworks.com
       • Poland—pl.chs.hawkeye.services-edge.paloaltonetworks.com
       • Spain—es.chs.hawkeye.services-edge.paloaltonetworks.com
       • Italy—it.chs.hawkeye.services-edge.paloaltonetworks.com
       • Israel—il.chs.hawkeye.services-edge.paloaltonetworks.com
       • Qatar—qa.chs.hawkeye.services-edge.paloaltonetworks.com
       • Saudi Arabia—sa.chs.hawkeye.services-edge.paloaltonetworks.com
       • Singapore—sg.chs.hawkeye.services-edge.paloaltonetworks.com
       • Japan—jp.chs.hawkeye.services-edge.paloaltonetworks.com
       • Korea—kr.chs.hawkeye.services-edge.paloaltonetworks.com
       • Taiwan—tw.chs.hawkeye.services-edge.paloaltonetworks.com
       • Indonesia—id.chs.hawkeye.services-edge.paloaltonetworks.com
       • India—in.chs.hawkeye.services-edge.paloaltonetworks.com
       • Australia—au.chs.hawkeye.services-edge.paloaltonetworks.com
       • South Africa—za.chs.hawkeye.services-edge.paloaltonetworks.com

     future use.
   • Override Discovered Advanced Address—Enable this option to manually override the Advanced Forwarding service address assigned by the discovery service. When enabled, the NGFW uses the address specified in Advanced Service Address instead of the discovery-assigned endpoint.
   • Advanced Service Address—The address for the Advanced Forwarding service used for inline cloud analysis payload exchange. Only configurable when Override Discovered Advanced Address is enabled.
     Ensure the advanced service address assigned by the discovery service is reachable from your network. If your network restricts outbound access, allow traffic to this address.
     • Advanced Service Address per Region
       • United States (Central)—usc1.pae.hawkeye.services-edge.paloaltonetworks.com
       • United States (East)—use4.pae.hawkeye.services-edge.paloaltonetworks.com
       • United States (West)—usw1.pae.hawkeye.services-edge.paloaltonetworks.com
       • Canada—ca.pae.hawkeye.services-edge.paloaltonetworks.com
       • Brazil—br.pae.hawkeye.services-edge.paloaltonetworks.com
       • Germany—de.pae.hawkeye.services-edge.paloaltonetworks.com
       • United Kingdom—uk.pae.hawkeye.services-edge.paloaltonetworks.com
       • Netherlands—nl.pae.hawkeye.services-edge.paloaltonetworks.com
       • Switzerland—ch.pae.hawkeye.services-edge.paloaltonetworks.com
       • France—fr.pae.hawkeye.services-edge.paloaltonetworks.com
       • Poland—pl.pae.hawkeye.services-edge.paloaltonetworks.com
       • Spain—es.pae.hawkeye.services-edge.paloaltonetworks.com
       • Italy—it.pae.hawkeye.services-edge.paloaltonetworks.com
       • Israel—il.pae.hawkeye.services-edge.paloaltonetworks.com
       • Qatar—qa.pae.hawkeye.services-edge.paloaltonetworks.com
       • Saudi Arabia—sa.pae.hawkeye.services-edge.paloaltonetworks.com
       • Singapore—sg.pae.hawkeye.services-edge.paloaltonetworks.com
       • Japan—jp.pae.hawkeye.services-edge.paloaltonetworks.com
       • Korea—kr.pae.hawkeye.services-edge.paloaltonetworks.com
       • Taiwan—tw.pae.hawkeye.services-edge.paloaltonetworks.com
       • Indonesia—id.pae.hawkeye.services-edge.paloaltonetworks.com
       • India—in.pae.hawkeye.services-edge.paloaltonetworks.com
       • Australia—au.pae.hawkeye.services-edge.paloaltonetworks.com
       • South Africa—za.pae.hawkeye.services-edge.paloaltonetworks.com
5. Click OK.
6. (Required for external proxy deployments only) If the firewall reaches the internet through an external proxy, configure the proxy server to forward Advanced Forwarding traffic.

   Select ConfigurationNGFW and Prisma AccessNetwork & DeviceDevice Setup, select the Management tab, and edit the Services settings. Specify the Proxy Server settings and enable Enable proxy for Inline Cloud Services.

   All Advanced Forwarding components (discovery service, Advanced Service health checks, Configuration Hub Service (reserved for future use), and Advanced Service TLS connections) use this proxy setting.

   Refer to the Discovery Service Address per Region, CHS Address per Region, and Advanced Service Address per Region lists for the FQDNs to allow.
7. Push the configuration.