>
    Strata Copilot
    Configure BYOIPs for Egress NAT
    Focus
    Download PDF
    Focus
    1. Home
    2. Cloud NGFW for AWS
    3. Cloud NGFW for AWS Administration
    4. Configure
    5. Configure in Strata Cloud Manager
    6. Configure Egress NAT
    7. Configure BYOIPs for Egress NAT
    Download PDF
    Cloud NGFW for AWS

    Configure BYOIPs for Egress NAT

    Table of Contents

    Configure BYOIPs for Egress NAT

    Use your own public IP addresses (BYOIPs) with Egress NAT in Strata Cloud Manager, expand a BYOIP pool in use, and monitor pool utilization in Amazon CloudWatch.
    Where Can I Use This?What Do I Need?
    • Cloud NGFW for AWS
    • Cloud NGFW subscription
    • Palo Alto Networks Customer Support Account (CSP)
    • AWS Marketplace account
    • User role (either tenant or administrator)
    • Strata Cloud Manager access (to configure Egress NAT in Strata Cloud Manager)
    You can transfer your BYOIP addresses from your AWS account to Cloud NGFW to avoid incurring hourly EIP management costs. Cloud NGFW then uses addresses from your own IP address space for source NAT on outbound traffic.

    Configure Egress NAT with Bring Your Own IPs (BYOIPs)

    Complete this task only if you chose Cloud NGFW Egress NAT and want to use your own IP address space. The BYOIP pool must be created and shared with your Cloud NGFW deployment account in AWS before you can reference it here, follow the steps in Create an IPAM Pool for BYOIPs to create and share the pool.
    1. In Strata Cloud Manager, return to the endpoint's Egress NAT configuration and select Bring Your Public IPs.
    2. Enter the IPAM Pool ID for the pool you shared with your Cloud NGFW deployment account.
      The IPAM Pool ID appears in the IPAM Pool Details section of the AWS VPC IP Address Manager console.
    3. Save the configuration.

    Add CIDRs to an In-Use BYOIP Pool

    You can now add new CIDRs to a BYOIP pool that is already associated with a Cloud NGFW endpoint without removing the pool from the endpoint or disrupting active traffic.
    1. In your AWS IPAM console, add the new CIDR to the existing BYOIP pool.
      See Provision CIDRs to a pool in the AWS documentation.
    2. In Strata Cloud Manager, select WorkflowsNGFW Setup and open the endpoint's Egress NAT configuration.
    3. Under BYOIP Pool, select Edit.
    4. Add the new CIDR to the list and Save.
    Removing CIDRs from an in-use BYOIP pool is not supported while the pool is active. To remove a CIDR, disassociate the pool from the endpoint first.

    Monitor BYOIP Pool Utilization in Amazon CloudWatch

    Cloud NGFW publishes BYOIP pool utilization metrics to Amazon CloudWatch so you can track address consumption and plan capacity before exhaustion.
    1. Open the Amazon CloudWatch console.
    2. Select MetricsAll metrics.
    3. Under Custom namespaces, choose CloudNGFW.
    4. Filter by your pool name or endpoint to view utilization metrics.
    Set CloudWatch alarms on BYOIP utilization metrics to receive notifications when pool consumption exceeds your threshold.

    © 2026 Palo Alto Networks, Inc. All rights reserved.