>
    Strata Copilot
    Edit Advanced IP Defense Connectivity Settings
    Focus
    Download PDF
    Focus
    1. Home
    2. Advanced IP Defense
    3. Edit Advanced IP Defense Connectivity Settings
    Download PDF
    Advanced IP Defense

    Edit Advanced IP Defense Connectivity Settings

    Table of Contents

    Edit Advanced IP Defense Connectivity Settings

    Configure connectivity settings to ensure reliable communication between your firewall and the Advanced IP Defense cloud service.
    Where Can I Use This?What Do I Need?
    • PAN-OS 12.2 and later
    • Strata Cloud Manager
    • Advanced IP Defense license
    • Admin access to firewall or Strata Cloud Manager
    • Network connectivity to Advanced IP Defense cloud service endpoints
    Advanced IP Defense relies on continuous communication between the firewall and the Advanced IP Defense cloud service to deliver real-time threat detection. The firewall sends two types of messages to the cloud: copies of DNS response IP-TTL pairs that the Advanced IP Defense cloud service uses to build a per-tenant DNS state table, and Advanced IP Defense lookup requests that query IP attributes and direct-to-IP status for a given destination. Because these exchanges happen inline with traffic processing, connectivity reliability directly affects detection accuracy and user experience.
    On a cache miss, the firewall allows the initial session to pass (fail-open) and asynchronously queries the Advanced IP Defense cloud service for a verdict. The firewall does not hold or buffer packets while waiting for the cloud response. Once the verdict is returned, the local cache is populated and the policy is strictly enforced on all subsequent sessions matching that IP. If the Advanced IP Defense cloud service becomes unreachable, the firewall reverts to fail-open to prevent a network outage.
    The firewall caches IP attributes locally to reduce the volume of cloud lookups. The firewall only queries the Advanced IP Defense cloud service on a cache miss—when it encounters an IP that isn't in the local cache or whose cached attributes have expired.
    The firewall also periodically pulls updated allowlist files from the cloud to pre-populate known-safe entries locally. This pull occurs at regular intervals and delivers two per-tenant files: one for the Advanced IP Defense allowlist and one for the direct-to-IP allowlist. If the firewall can't reach the cloud endpoint, it continues to use the most recent cached version of the allowlists. When the firewall reaches its maximum DNS cache capacity, it fails open on direct-to-IP detection and doesn't take action on direct-to-IP traffic until capacity is available.

    Edit Advanced IP Defense Connectivity Settings in Strata Cloud Manager

    Configure Strata Cloud Manager connectivity settings to enable communication with the Advanced IP Defense cloud service for real-time IP attribute lookups and direct-to-IP detection.
    Strata Cloud Manager manages connectivity settings for cloud-managed firewalls and Prisma Access deployments. Connectivity settings control how your cloud-managed infrastructure communicates with the Advanced IP Defense cloud service. Proper connectivity configuration ensures optimal performance and reliability of Advanced IP Defense threat detection across your cloud-managed environment.
    1. Use the credentials associated with your Palo Alto Networks support account and log in to the Strata Cloud Manager on the hub.
    2. Access the Advanced IP Defense connectivity settings in Strata Cloud Manager.
      Select ConfigurationDevice SettingsCloud Services to access connectivity settings for cloud-based security services.
    3. Verify Advanced IP Defense cloud service connectivity status.
      The cloud-managed infrastructure uses an asynchronous fail-open model for cloud lookups. On a cache miss, traffic is allowed to pass and the system queries the Advanced IP Defense cloud service asynchronously. Once the verdict is returned, the local cache is populated and the policy is enforced on subsequent sessions. If the Advanced IP Defense cloud service becomes unreachable, the system fails open to prevent a network outage.
      Ensure that network connectivity to the Advanced IP Defense cloud service endpoints on port 443 is stable. Verify DNS servers are configured and can resolve Advanced IP Defense cloud service domain names.
    4. (Optional) Configure proxy server settings for cloud connectivity.
      If your cloud-managed infrastructure is deployed behind a proxy server or in an environment that requires proxy authentication, you must configure proxy settings to enable communication with the Advanced IP Defense cloud service.
      Select ConfigurationDevice SettingsServices and configure the proxy server settings:
      • Enter the proxy server IP address or FQDN
      • Specify the proxy server port number
      • Enter proxy authentication credentials if required
      • Enable the option to use proxy for inline cloud services
      The proxy server password must contain a minimum of six characters.
    5. Verify network connectivity to Advanced IP Defense cloud service endpoints.
      Ensure that your cloud-managed infrastructure has network connectivity to the Advanced IP Defense cloud service endpoints. The infrastructure must be able to reach the Advanced IP Defense cloud service on port 443 (HTTPS) for secure communication.
      You can verify connectivity by:
      • Checking network routing to ensure traffic to Advanced IP Defense cloud service endpoints is not blocked
      • Verifying that security policies allow outbound HTTPS traffic to Advanced IP Defense cloud service IPs
      • Confirming that any proxy servers or firewalls between your infrastructure and the internet allow traffic to the Advanced IP Defense cloud service
    6. Configure DNS resolution for Advanced IP Defense cloud service endpoints.
      The cloud-managed infrastructure must be able to resolve the Advanced IP Defense cloud service domain names to IP addresses. Ensure that your infrastructure has access to DNS servers that can resolve these domain names.
      Select ConfigurationDevice SettingsServices and verify that DNS servers are configured. You can specify primary and secondary DNS servers to ensure redundancy.
    7. Test connectivity to the Advanced IP Defense cloud service.
      After configuring connectivity settings, test the connection to verify that the cloud-managed infrastructure can reach the Advanced IP Defense cloud service.
      Select ConfigurationDevice SettingsServices and click Test Connectivity to verify that the infrastructure can successfully communicate with the Advanced IP Defense cloud service. A successful test confirms that your connectivity settings are correct.
    8. Monitor Advanced IP Defense cloud service connectivity status.
      After enabling Advanced IP Defense, monitor the connectivity status to ensure the cloud-managed infrastructure maintains a stable connection to the Advanced IP Defense cloud service.
      Select MonitorSystemCloud Services to view the status of Advanced IP Defense cloud service connections. Check for any connectivity errors or warnings that may indicate network issues.
    9. Commit your changes.
      Click Commit to apply the connectivity settings to your Strata Cloud Manager configuration.

    Edit Advanced IP Defense Connectivity Settings in PAN-OS and Panorama

    Configure PAN-OS and Panorama connectivity settings to enable communication with the Advanced IP Defense cloud service for real-time IP attribute lookups and direct-to-IP detection.
    PAN-OS and Panorama manage connectivity settings for on-premises firewalls and Panorama-managed deployments. Connectivity settings control how your firewall or Panorama communicates with the Advanced IP Defense cloud service. Proper connectivity configuration ensures optimal performance and reliability of Advanced IP Defense threat detection across your on-premises infrastructure.
    1. Log in to the
    2. Access the Advanced IP Defense connectivity settings.
      In PAN-OS or Panorama, select DeviceSetupContent-ID to access the global connectivity settings for cloud-based security services.
    3. Verify Advanced IP Defense cloud service connectivity status.
      The firewall uses an asynchronous fail-open model for cloud lookups. On a cache miss, the firewall allows the initial session and queries the Advanced IP Defense cloud service asynchronously. Once the verdict is returned, the local cache is populated and the policy is enforced on subsequent sessions. If the Advanced IP Defense cloud service becomes unreachable, the firewall fails open to prevent a network outage.
      Ensure that network connectivity to the Advanced IP Defense cloud service endpoints on port 443 is stable. Verify DNS servers are configured and can resolve Advanced IP Defense cloud service domain names.
    4. (Optional) Configure proxy server settings for cloud connectivity.
      If your firewall is deployed behind a proxy server or in an environment that requires proxy authentication, you must configure proxy settings to enable communication with the Advanced IP Defense cloud service.
      Select DeviceSetupServices and configure the proxy server settings:
      • Enter the proxy server IP address or FQDN
      • Specify the proxy server port number
      • Enter proxy authentication credentials if required
      • Enable the option to use proxy for inline cloud services
      The proxy server password must contain a minimum of six characters.
    5. Verify network connectivity to Advanced IP Defense cloud service endpoints.
      Ensure that your firewall has network connectivity to the Advanced IP Defense cloud service endpoints. The firewall must be able to reach the Advanced IP Defense cloud service on port 443 (HTTPS) for secure communication.
      You can verify connectivity by:
      • Checking firewall routing to ensure traffic to Advanced IP Defense cloud service endpoints is not blocked
      • Verifying that security policies allow outbound HTTPS traffic to Advanced IP Defense cloud service IPs
      • Confirming that any proxy servers or firewalls between your firewall and the internet allow traffic to the Advanced IP Defense cloud service
    6. Configure DNS resolution for Advanced IP Defense cloud service endpoints.
      The firewall must be able to resolve the Advanced IP Defense cloud service domain names to IP addresses. Ensure that your firewall has access to DNS servers that can resolve these domain names.
      Select DeviceSetupServices and verify that DNS servers are configured. You can specify primary and secondary DNS servers to ensure redundancy.
    7. Test connectivity to the Advanced IP Defense cloud service.
      After configuring connectivity settings, test the connection to verify that the firewall can reach the Advanced IP Defense cloud service.
      Select DeviceSetupServices and click Test Connectivity to verify that the firewall can successfully communicate with the Advanced IP Defense cloud service. A successful test confirms that your connectivity settings are correct.
    8. Monitor Advanced IP Defense cloud service connectivity status.
      After enabling Advanced IP Defense, monitor the connectivity status to ensure the firewall maintains a stable connection to the Advanced IP Defense cloud service.
      Select MonitorSystemCloud Services to view the status of Advanced IP Defense cloud service connections. Check for any connectivity errors or warnings that may indicate network issues.
    9. Commit your changes.
      Click Commit to apply the connectivity settings to your firewall.

    © 2026 Palo Alto Networks, Inc. All rights reserved.