Configure Your Network to Allow Cloud Identity Agent Traffic
If you have an on-premises Active Directory, configure
your network to allow traffic for the agent, your Active Directory,
and the Cloud Identity Engine.
If you have configured firewalls between your
on-premises Active Directory and the agent host, allow the traffic
for the agent, your Active Directory, and the Cloud Identity Engine.
The
Cloud Identity agent version 1.7.0 and previous versions require
direct reachability to the regional agent configuration endpoint
and do not support proxy servers between the agent and the endpoint.
If your network configuration uses a proxy server, you must Update the Cloud Identity Agent to version
1.7.1.
If you have deployed a Palo Alto Networks
firewall between the agent and the Cloud Identity Engine:
Use the
paloalto-cloud-identity
App-ID
to allow traffic from the Cloud Identity agent to the Cloud Identity
Engine. This App-ID requires the
ssl
and
web-browsing
application
signatures.
Allow traffic from the Cloud Identity agent from the specified
ports to the following URLs.
http://crl.godaddy.com
on
port 80.
http://ocsp.godaddy.com
on port 80.
https://certs.godaddy.com
on port 443.
If you’re using Secure Socket Layer (SSL) decryption on the
firewall, exclude the traffic between
the agent and the Cloud Identity Engine from SSL decryption to allow
the mutual authentication between the agent and the service.
If you have deployed a Palo Alto Networks firewall between
the agent and the Active Directory:
Depending on which protocol you select when you Configure the Cloud Identity Agent, use one of the following
App-IDs to allow traffic from the Cloud Identity agent to your domain
controllers.
If the agent uses
the LDAP protocol, use the
ldap
App-ID.
If the agent uses the LDAPS or LDAP with STARTTLS protocol,
use the
ssl
App-ID.
If you are using a non-Palo Alto Networks firewall:
Allow traffic to the LDAP
or LDAPS port and protocol from the Cloud Identity agent to your
Active Directory or Domain Controller.
Allow HTTPS traffic from the Cloud Identity agent on port 443
to your Cloud Identity Engine destination URL. You need to allow
traffic only for the region that you specify for your instance and
you need to allow traffic for multiple regions only if you have
instances in multiple regions. For the region-specific agent configurations,
refer to Configure the Cloud Identity Agent.
Allow traffic from the Cloud Identity agent from the specified
ports to the following URLs.
