PAN-OS

1. Log in to the web interface.

   • NGFW—Log in to the PAN-OS web interface.
   • Panorama—Log in to the Panorama web interface.
2. Navigate to the Content-ID settings.

   • NGFW—Select DeviceSetupContent-ID and edit the Content Cloud Settings.
   • Panorama—Select DeviceSetupContent-ID and select the Template associated with the managed firewalls that you want to enable Advanced Forwarding on.
3. Enable Advanced Forwarding.

   Switching from the legacy transport mode to Advanced Forwarding causes a momentary disruption to the cloud connection. It is recommended to commit this change during a maintenance window.
4. Configure the Advanced Forwarding settings.

   • Discovery Service Address—The address for the discovery service that dynamically assigns advanced service addresses to the NGFW based on its serial number, PAN-OS version, and geographic location (default: pae-discovery.hawkeye.services-edge.paloaltonetworks.com). By default, the discovery service address resolves to the closest regional IP address.
     Ensure the discovery service address is reachable from your network. If your network restricts outbound access, allow traffic to this address so the NGFW can query for its assigned advanced service addresses.
     • Discovery Service Address per Region
       • United States (Central)—usc1.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • United States (East)—use4.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • United States (West)—usw1.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Canada—ca.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Brazil—br.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Germany—de.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • United Kingdom—uk.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Netherlands—nl.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Switzerland—ch.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • France—fr.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Poland—pl.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Spain—es.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Italy—it.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Israel—il.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Qatar—qa.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Saudi Arabia—sa.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Singapore—sg.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Japan—jp.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Korea—kr.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Taiwan—tw.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Indonesia—id.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • India—in.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • Australia—au.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
       • South Africa—za.pae-discovery.hawkeye.services-edge.paloaltonetworks.com
   • Discovery Service Interval (seconds)—The interval, in seconds, between discovery service queries. The NGFW periodically queries the discovery service to refresh its assigned advanced service addresses (default is 14400 seconds).
   • Max Discovery Retry Count—The maximum number of times the NGFW retries a failed discovery service query.

     The NGFW retries failed discovery queries every 60 seconds up to the configured maximum retry count. Once exhausted, retries continue at 5 minute intervals until discovery is successful.
   • Enable Multi-FQDN Support—Enable the NGFW to use multiple advanced service address FQDNs simultaneously. When enabled, the discovery service can assign different FQDNs for different cloud analysis services, allowing the NGFW to distribute connections across multiple endpoints. Reserved for future use.
   • Override Discovered CHS Address—Enable this option to manually override the Config Hub Service (CHS) address assigned by the discovery service. When enabled, the NGFW uses the address specified in Config Hub Service (CHS) Address instead of the discovery-assigned endpoint. Reserved for future use.
   • Config Hub Service (CHS) Address—The address for the Config Hub Service (CHS) that the NGFW uses to store and retrieve configuration. Only configurable when Override Discovered CHS Address is enabled. Reserved for

     • CHS Address per Region
       The Configuration Hub Service is reserved for future use. These addresses are provided as a reference for proxy allowlist configuration.
       • United States (Central)—usc1.chs.hawkeye.services-edge.paloaltonetworks.com
       • United States (East)—use4.chs.hawkeye.services-edge.paloaltonetworks.com
       • United States (West)—usw1.chs.hawkeye.services-edge.paloaltonetworks.com
       • Canada—ca.chs.hawkeye.services-edge.paloaltonetworks.com
       • Brazil—br.chs.hawkeye.services-edge.paloaltonetworks.com
       • Germany—de.chs.hawkeye.services-edge.paloaltonetworks.com
       • United Kingdom—uk.chs.hawkeye.services-edge.paloaltonetworks.com
       • Netherlands—nl.chs.hawkeye.services-edge.paloaltonetworks.com
       • Switzerland—ch.chs.hawkeye.services-edge.paloaltonetworks.com
       • France—fr.chs.hawkeye.services-edge.paloaltonetworks.com
       • Poland—pl.chs.hawkeye.services-edge.paloaltonetworks.com
       • Spain—es.chs.hawkeye.services-edge.paloaltonetworks.com
       • Italy—it.chs.hawkeye.services-edge.paloaltonetworks.com
       • Israel—il.chs.hawkeye.services-edge.paloaltonetworks.com
       • Qatar—qa.chs.hawkeye.services-edge.paloaltonetworks.com
       • Saudi Arabia—sa.chs.hawkeye.services-edge.paloaltonetworks.com
       • Singapore—sg.chs.hawkeye.services-edge.paloaltonetworks.com
       • Japan—jp.chs.hawkeye.services-edge.paloaltonetworks.com
       • Korea—kr.chs.hawkeye.services-edge.paloaltonetworks.com
       • Taiwan—tw.chs.hawkeye.services-edge.paloaltonetworks.com
       • Indonesia—id.chs.hawkeye.services-edge.paloaltonetworks.com
       • India—in.chs.hawkeye.services-edge.paloaltonetworks.com
       • Australia—au.chs.hawkeye.services-edge.paloaltonetworks.com
       • South Africa—za.chs.hawkeye.services-edge.paloaltonetworks.com

     future use.
   • Override Discovered Advanced Address—Enable this option to manually override the Advanced Forwarding service address assigned by the discovery service. When enabled, the NGFW uses the address specified in Advanced Service Address instead of the discovery-assigned endpoint.
   • Advanced Service Address—The address for the Advanced Forwarding service used for inline cloud analysis payload exchange. Only configurable when Override Discovered Advanced Address is enabled.
     Ensure the advanced service address assigned by the discovery service is reachable from your network. If your network restricts outbound access, allow traffic to this address.
     • Advanced Service Address per Region
       • United States (Central)—usc1.pae.hawkeye.services-edge.paloaltonetworks.com
       • United States (East)—use4.pae.hawkeye.services-edge.paloaltonetworks.com
       • United States (West)—usw1.pae.hawkeye.services-edge.paloaltonetworks.com
       • Canada—ca.pae.hawkeye.services-edge.paloaltonetworks.com
       • Brazil—br.pae.hawkeye.services-edge.paloaltonetworks.com
       • Germany—de.pae.hawkeye.services-edge.paloaltonetworks.com
       • United Kingdom—uk.pae.hawkeye.services-edge.paloaltonetworks.com
       • Netherlands—nl.pae.hawkeye.services-edge.paloaltonetworks.com
       • Switzerland—ch.pae.hawkeye.services-edge.paloaltonetworks.com
       • France—fr.pae.hawkeye.services-edge.paloaltonetworks.com
       • Poland—pl.pae.hawkeye.services-edge.paloaltonetworks.com
       • Spain—es.pae.hawkeye.services-edge.paloaltonetworks.com
       • Italy—it.pae.hawkeye.services-edge.paloaltonetworks.com
       • Israel—il.pae.hawkeye.services-edge.paloaltonetworks.com
       • Qatar—qa.pae.hawkeye.services-edge.paloaltonetworks.com
       • Saudi Arabia—sa.pae.hawkeye.services-edge.paloaltonetworks.com
       • Singapore—sg.pae.hawkeye.services-edge.paloaltonetworks.com
       • Japan—jp.pae.hawkeye.services-edge.paloaltonetworks.com
       • Korea—kr.pae.hawkeye.services-edge.paloaltonetworks.com
       • Taiwan—tw.pae.hawkeye.services-edge.paloaltonetworks.com
       • Indonesia—id.pae.hawkeye.services-edge.paloaltonetworks.com
       • India—in.pae.hawkeye.services-edge.paloaltonetworks.com
       • Australia—au.pae.hawkeye.services-edge.paloaltonetworks.com
       • South Africa—za.pae.hawkeye.services-edge.paloaltonetworks.com
5. Click OK.
6. (Required for external proxy deployments only) If the firewall reaches the internet through an external proxy, configure the proxy server to forward Advanced Forwarding traffic.

   Select DeviceSetupServices and edit the Services details. Specify the Proxy Server settings and enable Enable proxy for Inline Cloud Services.

   Alternatively, enable the inline cloud proxy via CLI:

   set deviceconfig system inline-cloud-proxy yes

   All Advanced Forwarding components (discovery service, Advanced Service health checks, Configuration Hub Service (reserved for future use), and Advanced Service TLS connections) use this proxy setting.

   Refer to the Discovery Service Address per Region, CHS Address per Region, and Advanced Service Address per Region lists for the FQDNs to allow.
7. Commit the configuration.
8. (Optional) Validate the Advanced Forwarding configuration through the CLI.

   Verify that the discovery service query completed successfully:

   admin@firewall> show paed discovery-status
   
   PAE Job Status:
   
    Recent Jobs:
     Service: pae
      Operation: Discovery
      Request ID: 9590
      Timestamp: Wed Jul 29 14:10:43 2026
      Status: Completed
      FQDN Used: pae-discovery.hawkeye.services-edge.paloaltonetworks.com
      IP Used: 192.0.2.10
      Request Length: 329 bytes
      Response Length: 584 bytes
      CURL Code: 0
      HTTP Code: 200
      SVC Status Code: Valid

   Verify the discovered Advanced Service and CHS FQDNs assigned to the NGFW:

   admin@firewall> show paed fqdns
   
   Current FQDNs:
   
    Service: pae
   
     FQDN s1dp0:
      Request ID: 9590
      Slot ID: 1
      DP ID: 0
      Service: pae
      Service Version: 1
      Subservice: pae-fqdns
      Update Time: Wed Jul 29 14:10:43 2026
      FQDN: usc1.pae.hawkeye.services-edge.paloaltonetworks.com
      Port: 443
      Inline Proxy: disabled
      IP Address: 198.51.100.25
      Protocol: v4
      FQDN Type: Dynamic
      Valid Start: Fri Jun 19 11:53:42 2026
      Valid End: Wed Jun 25 17:00:00 2036
      Region: us-central1
      Health Check:
       Pod Name: paesvc-api-744d65c7dc-hgh68
       Version: 1.0.0.0-2_aabac9591b
       Built on: 2026-07-23T10:32:32PDT
       Config mgmt: yes
       Backend: yes
       Status: yes
   
     CHS FQDN:
      Request ID: 9590
      Service: pae
      Service Version: 1
      Subservice: chs-fqdns
      Update Time: Wed Jul 29 14:10:43 2026
      FQDN: usc1.chs.hawkeye.services-edge.paloaltonetworks.com
      FQDN Type: Dynamic
      Valid Start: Mon Jun 29 22:48:45 2026
      Valid End: Sun Jul 6 17:00:00 2036
      Region: us-central1

   Verify that the data plane has established active connections to the advanced services:

   admin@firewall> debug dataplane pae show connections list active
   
   Active Connections:
    Total connections in list Active: 4
    ID: 12  State: ACTIVE
    ID: 14  State: ACTIVE
    ID: 13  State: ACTIVE
    ID: 3   State: ACTIVE

   The number of active connections depends on your hardware platform:

   • PA-3420—Minimum 1, up to 2 concurrent TLS connections
   • Other PA-34xx series—Minimum 2, up to 4 concurrent TLS connections
   • All other platforms—Minimum 4, up to 8 concurrent TLS connections

   If the output displays Advanced Forwarding is not enabled, verify that you enabled Advanced Forwarding and committed the configuration.