>
    Strata Copilot
    Edit Advanced IP Defense Connectivity Settings in PAN-OS and Panorama
    Focus
    Download PDF
    Focus
    1. Home
    2. Advanced IP Defense
    3. Edit Advanced IP Defense Connectivity Settings
    4. Edit Advanced IP Defense Connectivity Settings in PAN-OS and Panorama
    Download PDF
    Advanced IP Defense

    Edit Advanced IP Defense Connectivity Settings in PAN-OS and Panorama

    Table of Contents

    Edit Advanced IP Defense Connectivity Settings in PAN-OS and Panorama

    Configure the Advanced IP Defense cloud endpoint and verify connectivity from your firewall.
    Before configuring Advanced IP Defense connectivity, ensure:
    • Enforcement points can reach Advanced IP Defense endpoints on TCP 443. If your enforcement point is behind a proxy, configure proxy settings under DeviceSetupServices.
    • DNS servers are configured and can resolve Advanced IP Defense domain names. For the full list of domains, see Regional Service Domains.
    The Advanced IP Defense connectivity settings control which cloud endpoint the enforcement point uses for real-time IP attribute lookups and direct-to-IP detection. The enforcement point communicates with Advanced IP Defense over TLS on TCP 443.
    1. Log in to the PAN-OS web interface.
    2. Select DeviceSetupContent-ID.
    3. In the Advanced IP Defense Settings section, click the edit icon.
    4. Set the AIPD Cloud Endpoint to a Regional Service Domains FQDN.
      By default, enforcement point uses the global anycast FQDN, which routes lookups to the nearest regional server. You can configure a specific regional FQDN for latency optimization or data residency requirements.
    5. Click OK and Commit your changes.
    6. Verify connectivity by running the following CLI command:
      show ip-defense status
      A successful response confirms that the firewall can reach Advanced IP Defense.

    © 2026 Palo Alto Networks, Inc. All rights reserved.