Prisma Access
Allow Listing GlobalProtect Mobile Users
Table of Contents
Expand All
|
Collapse All
Prisma Access Docs
-
5.2 Preferred and Innovation
- 5.2 Preferred and Innovation
- 5.1 Preferred and Innovation
- 5.0 Preferred and Innovation
- 4.2 Preferred
- 4.1 Preferred
- 4.0 Preferred
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
-
-
-
-
- Allocate Licenses for Prisma Access (Managed by Strata Cloud Manager)
- Plan Service Connections for Prisma Access (Managed by Strata Cloud Manager) and Add-ons
- Add Additional Locations for Prisma Access (Managed by Strata Cloud Manager) and Add-ons
- Enable Available Add-ons for Prisma Access (Managed by Strata Cloud Manager)
- Enable Dynamic Privilege Access for Prisma Access (Managed by Strata Cloud Manager)
- Search for Subscription Details
- Share a License for Prisma Access (Managed by Strata Cloud Manager) and Add-ons
- Increase Subscription Allocation Quantity
-
- Activate a License for Prisma Access (Managed by Strata Cloud Manager) and Prisma SD-WAN Bundle
-
- Onboard Prisma Access
-
4.0 & Later
- 4.0 & Later
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
- Prisma Access China
-
- Set Up Prisma Access
- Configure the Prisma Access Service Infrastructure
- Remote Networks: IPSec Termination Nodes and Service IP Addresses
- Remote Networks: IP Address Changes Related To Bandwidth Allocation
- Remote Networks: Service IP Address and Egress IP Address Allocation
- API Examples for Retrieving Prisma Access IP Addresses
- Get Notifications When Prisma Access IP Addresses Change
- Prisma Access Zones
- DNS for Prisma Access
- High Availability for Prisma Access
-
- Enable ZTNA Connector
- Delete Connector IP Blocks
- Set Up Auto Discovery of Applications Using Cloud Identity Engine
- Private Application Target Discovery
- Security Policy for Apps Enabled with ZTNA Connector
- Monitor ZTNA Connector
- View ZTNA Connector Logs
- Preserve User-ID Mapping for ZTNA Connector Connections with Source NAT
-
- Enable Dynamic Privilege Access for Prisma Access Through Common Services
- Authorize User Group Mapping in Cloud Identity Engine for Dynamic Privilege Access
- Enable the Access Agent
- Set Up the Agent Infrastructure for Dynamic Privilege Access
- Create a Snippet
- Create a Project
- Traffic Steering for Dynamic Privilege Access
- Push the Prisma Access Agent Configuration
- Download the Dynamic Privilege Access Enabled Prisma Access Agent Package
-
- Install the Prisma Access Agent
- Log in to the Dynamic Privilege Access Enabled Prisma Access Agent
- Change Preferences for the Dynamic Privilege Access Enabled Prisma Access Agent
- Connect the Dynamic Privilege Access Enabled Prisma Access Agent to a Different Location
- Switch to a Different Project
- Connect the Dynamic Privilege Access Enabled Prisma Access Agent to a Different Server
- Disable the Dynamic Privilege Access Enabled Prisma Access Agent
- Switch Between the Prisma Access Agent and GlobalProtect App
- View and Monitor Dynamic Privilege Access Users
- View and Monitor Dynamic Privilege Access Projects
- App Acceleration in Prisma Access
-
-
- Planning Checklist for GlobalProtect on Prisma Access
- Set Up GlobalProtect Mobile Users
- GlobalProtect — Customize Tunnel Settings
- GlobalProtect — Customize App Settings
- Ticket Request to Disable GlobalProtect
- GlobalProtect Pre-Logon
- GlobalProtect — Clientless VPN
- Monitor GlobalProtect Mobile Users
- How the GlobalProtect App Selects Prisma Access Locations for Mobile Users
- Allow Listing GlobalProtect Mobile Users
-
- Explicit Proxy Configuration Guidelines
- GlobalProtect in Proxy Mode
- GlobalProtect in Tunnel and Proxy Mode
- Private IP Address Visibility and Enforcement for Agent Based Proxy Traffic
- SAML Authentication for Explicit Proxy
- Set Up Explicit Proxy
- Cloud Identity Engine Authentication for Explicit Proxy Deployments
- Proxy Mode on Remote Networks
- How Explicit Proxy Identifies Users
- Explicit Proxy Forwarding Profiles
- PAC File Guidelines
- Explicit Proxy Best Practices
- Monitor and Troubleshoot Explicit Proxy
- Block Settings for Explicit Proxy
- Use Special Objects to Restrict Explicit Proxy Internet Traffic to Specific IP Addresses
- Access Your Data Center Using Explicit Proxy
- App-Based Office 365 Integration with Explicit Proxy
- Configure Proxy Chaining with Blue Coat Proxy
- IP Address Optimization for Explicit Proxy Users- Proxy Deployments
- DNS Resolution for Mobile Users—Explicit Proxy Deployments
- View User to IP Address or User Groups Mappings
- Report Mobile User Site Access Issues
- Enable Mobile Users to Access Corporate Resources
-
-
- Planning Checklist for Remote Networks
- Allocate Remote Network Bandwidth
- Onboard a Remote Network
- Connect a Remote Network Site to Prisma Access
- Enable Routing for Your Remote Network
- Onboard Multiple Remote Networks
- Configure Remote Network and Service Connection Connected with a WAN Link
- Remote Networks—High Performance
- Integrate a Shared Desktop VDI with Prisma Access Using Terminal Server
-
- Multitenancy Configuration Overview
- Plan Your Multitenant Deployment
- Create an All-New Multitenant Deployment
- Enable Multitenancy and Migrate the First Tenant
- Add Tenants to Prisma Access
- Delete a Tenant
- Create a Tenant-Level Administrative User
- Sort Logs by Device Group ID in a Multitenant Deployment
-
- Add a New Compute Location for a Deployed Prisma Access Location
- How BGP Advertises Mobile User IP Address Pools for Service Connections and Remote Network Connections
- Proxy Support for Prisma Access and Strata Logging Service
- Block Incoming Connections from Specific Countries
- Prisma Access for No Default Route Networks
-
-
- Default Routes With Prisma Access Traffic Steering
- Traffic Steering in Prisma Access
- Traffic Steering Requirements
- Default Routes with Traffic Steering Example
- Default Routes with Traffic Steering Direct to Internet Example
- Default Routes with Traffic Steering and Dedicated Service Connection Example
- Prisma Access Traffic Steering Rule Guidelines
- Configure Zone Mapping and Security Policies for Traffic Steering Dedicated Connections
- Configure Traffic Steering in Prisma Access
- Preserve User-ID and Device-ID Mapping for Service Connections with Source NAT
-
- Prisma Access Internal Gateway
-
- Configure Privileged Remote Access Settings
- Set Up the Privileged Remote Access Portal
- Configure Applications for Privileged Remote Access
- Set Up Privileged Remote Access Profiles
- Define Permissions for Accessing Privileged Remote Access Apps
- Configure Split Tunneling for Privileged Remote Access Traffic
- Manage Privileged Remote Access Connections
- Use Privileged Remote Access
-
- Integrate Prisma Access With Other Palo Alto Networks Apps
- Integrate Third-Party Enterprise Browser with Explicit Proxy
-
-
- Connect your Mobile Users in Mainland China to Prisma Access Overview
- Configure Prisma Access for Mobile Users in China
- Configure Real-Name Registration and Create the VPCs in Alibaba Cloud
- Attach the CEN and Specify the Bandwidth
- Create Linux Instances in the Alibaba Cloud VPCs
- Configure the Router Instances
- Onboard the GlobalProtect Gateway and Configure the Prisma Access Portal
-
-
-
- INC_CIE_AGENT_DISCONNECT
- INC_CIE_DIRECTORY_DISCONNECT
- INC_GLOBALPROTECT_GW_USER_AUTH_ TIMEOUT_FAILURES_COUNT_EXCEEDED_ ABOVE_BASELINE_ALL_PA_LOCATIONS
- INC_GLOBALPROTECT_GW_USER_AUTH_ TIMEOUT_FAILURES_COUNT_EXCEEDED_ ABOVE_BASELINE_PER_PA_LOCATION
- INC_GLOBALPROTECT_PORTAL_AUTH_ TIMEOUT_FAILURES_COUNT_EXCEEDED_ ABOVE_BASELINE_ALL_PA_LOCATIONS
- INC_GLOBALPROTECT_PORTAL_AUTH_ TIMEOUT_FAILURES_COUNT_EXCEEDED_ ABOVE_BASELINE_PER_PA_LOCATION
- INC_PORTAL_CLIENTLESS_VPN_AUTH_ TIMEOUT_FAILURES_COUNT_EXCEEDED_ ABOVE_BASELINE_ALL_PA_LOCATIONS
- INC_PORTAL_CLIENTLESS_VPN_AUTH_ TIMEOUT_FAILURES_COUNT_EXCEEDED_ ABOVE_BASELINE_PER_PA_LOCATION
- INC_MU_AUTH_SERVER_UNREACHABLE_ALL_ PA_LOCATIONS
- INC_MU_AUTH_SERVER_UNREACHABLE_PER_ PA_LOCATION
- INC_MU_DNS_SERVER_UNREACHABLE_ALL_ PA_LOCATIONS
- INC_MU_DNS_SERVER_UNREACHABLE_ PER_PA_LOCATION
- INC_RN_AUTH_SERVER_UNREACHABLE_ALL_ PA_LOCATIONS
- INC_RN_AUTH_SERVER_UNREACHABLE_PER_ PA_LOCATION
- INC_RN_DNS_SERVER_UNREACHABLE_ALL_ PA_LOCATIONS
- INC_RN_DNS_SERVER_UNREACHABLE_PER_ PA_LOCATION
- INC_RN_ECMP_TUNNEL_RTT_EXCEEDED_ BASELINE
- INC_RN_PRIMARY_WAN_TUNNEL_RTT_ EXCEEDED_BASELINE
- INC_RN_SECONDARY_TUNNEL_DOWN
- INC_RN_SECONDARY_WAN_TUNNEL_RTT_ EXCEEDED_BASELINE
- INC_RN_SITE_CAPACITY_PREDICTION
- INC_SC_PRIMARY_WAN_TUNNEL_RTT_ EXCEEDED_BASELINE
- INC_SC_SECONDARY_WAN_TUNNEL_RTT_ EXCEEDED_BASELINE
- INC_SC_SITE_CAPACITY_PREDICTION
-
- INC_CERTIFICATE_EXPIRY
- INC_GP_CLIENT_VERSION_UNSUPPORTED
- INC_MU_IP_POOL_BLOCK_UTILIZATION_ EXCEEDED_CAPACITY
- INC_MU_IP_POOL_BLOCK_UTILIZATION_ EXCEEDED_THRESHOLD
- INC_PA_INFRA_DEGRADATION
- INC_PA_SERVICE_DEGRADATION_PA_LOCATION
- INC_PA_SERVICE_DEGRADATION_RN_ SITE_CONNECTIVITY
- INC_PA_SERVICE_DEGRADATION_SC_ CONNECTIVITY
- INC_RN_ECMP_BGP_DOWN
- INC_RN_ECMP_BGP_FLAP
- INC_RN_ECMP_PROXY_TUNNEL_DOWN
- INC_RN_ECMP_PROXY_TUNNEL_FLAP
- INC_RN_ECMP_TUNNEL_DOWN
- INC_RN_ECMP_TUNNEL_FLAP
- INC_RN_PRIMARY_WAN_BGP_FLAP
- INC_RN_PRIMARY_WAN_PROXY_TUNNEL_DOWN
- INC_RN_PRIMARY_WAN_PROXY_TUNNEL_FLAP
- INC_RN_PRIMARY_WAN_TUNNEL_DOWN
- INC_RN_PRIMARY_WAN_TUNNEL_FLAP
- INC_RN_SECONDARY_WAN_BGP_DOWN
- INC_RN_SECONDARY_WAN_BGP_FLAP
- INC_RN_SECONDARY_WAN_PROXY_TUNNEL_DOWN
- INC_RN_SECONDARY_WAN_PROXY_TUNNEL_FLAP
- INC_RN_SECONDARY_WAN_TUNNEL_DOWN
- INC_RN_SECONDARY_WAN_TUNNEL_FLAP
- INC_RN_SITE_DOWN
- INC_RN_SITE_LONG_DURATION_CAPACITY_ EXCEEDED_THRESHOLD
- INC_RN_SITE_LONG_DURATION_EXCEEDED_ CAPACITY
- INC_RN_SPN_LONG_DURATION_CAPACITY_EXCEEDED _THRESHOLD
- INC_RN_SPN_LONG_DURATION_EXCEEDED_ CAPACITY
- INC_SC_PRIMARY_WAN_BGP_DOWN
- INC_SC_PRIMARY_WAN_BGP_FLAP
- INC_SC_PRIMARY_WAN_PROXY_TUNNEL_DOWN
- INC_SC_PRIMARY_WAN_PROXY_TUNNEL_FLAP
- INC_SC_PRIMARY_WAN_TUNNEL_DOWN
- INC_SC_PRIMARY_WAN_TUNNEL_FLAP
- INC_SC_SECONDARY_WAN_BGP_DOWN
- INC_SC_SECONDARY_WAN_BGP_FLAP
- INC_SC_SECONDARY_WAN_PROXY_TUNNEL_DOWN
- INC_SC_SECONDARY_WAN_PROXY_TUNNEL_FLAP
- INC_SC_SECONDARY_WAN_TUNNEL_DOWN
- INC_SC_SECONDARY_WAN_TUNNEL_FLAP
- INC_SC_SITE_DOWN
- INC_SC_SITE_LONG_DURATION_CAPACITY_ EXCEEDED_THRESHOLD
- INC_SC_SITE_LONG_DURATION_EXCEEDED_ CAPACITY
- INC_ZTNA_CONNECTOR_APP_STATUS_DOWN
- INC_ZTNA_CONNECTOR_APP_STATUS_DOWN_PARTIAL
- INC_ZTNA_CONNECTOR_CPU_HIGH
- INC_ZTNA_CONNECTOR_MEMORY_HIGH
- INC_ZTNA_CONNECTOR_TUNNEL_DOWN
-
- AL_CIE_AGENT_DISCONNECT
- AL_CIE_DIRECTORY_DISCONNECT
- AL_MU_IP_POOL_CAPACITY
- AL_MU_IP_POOL_USAGE
- AL_RN_ECMP_BGP_DOWN
- AL_RN_ECMP_BGP_FLAP
- AL_RN_PRIMARY_WAN_BGP_DOWN
- AL_RN_PRIMARY_WAN_BGP_FLAP
- AL_RN_PRIMARY_WAN_TUNNEL_DOWN
- AL_RN_PRIMARY_WAN_TUNNEL_FLAP
- AL_RN_SECONDARY_WAN_BGP_DOWN
- AL_RN_SECONDARY_WAN_BGP_FLAP
- AL_RN_SECONDARY_WAN_TUNNEL_DOWN
- AL_RN_SECONDARY_WAN_TUNNEL_FLAP
- AL_RN_SITE_DOWN
- AL_RN_SITE_LONG_DURATION_CAPACITY_ EXCEEDED_THRESHOLD
- AL_RN_SITE_LONG_DURATION_EXCEEDED_ CAPACITY
- AL_RN_SPN_LONG_DURATION_CAPACITY_ EXCEEDED_THRESHOLD
- AL_SC_PRIMARY_WAN_BGP_DOWN
- AL_SC_PRIMARY_WAN_BGP_FLAP
- AL_SC_PRIMARY_WAN_TUNNEL_DOWN
- AL_SC_PRIMARY_WAN_TUNNEL_FLAP
- AL_SC_SECONDARY_WAN_BGP_DOWN
- AL_SC_SECONDARY_WAN_BGP_FLAP
- AL_SC_SECONDARY_WAN_TUNNEL_DOWN
- AL_SC_SECONDARY_WAN_TUNNEL_FLAP
- AL_SC_SITE_DOWN
- AL_SC_SITE_LONG_DURATION_CAPACITY_ EXCEEDED_THRESHOLD
- AL_SC_SITE_LONG_DURATION_EXCEEDED_CAPACITY
- AL_ZTNA_CONNECTOR_APP_STATUS_DOWN
- AL_ZTNA_CONNECTOR_APP_STATUS_DOWN_PARTIAL
- AL_ZTNA_CONNECTOR_CPU_HIGH
- AL_ZTNA_CONNECTOR_MEMORY_HIGH
- AL_ZTNA_CONNECTOR_TUNNEL_DOWN
- New Features in Incidents and Alerts
- Known Issues
Allow Listing GlobalProtect Mobile Users
Learn how to enable the egress IP allowlists for existing mobile users.
Where Can I Use This? | What Do I Need? |
---|---|
|
|
Learn how to enable the egress IP allowlists for existing mobile
users.
To enable you to add the public (egress) IP addresses for your GlobalProtect—Mobile User
deployment to any SaaS application allow lists you use within your organization, Prisma
Access provides the IP addresses and lets you verify that you have added them to your
allow list before using them in your environment. If you enable egress IP allowlists for
existing Prisma Access deployments, Prisma Access migrates all the egress IP addresses
already allocated for your locations to the egress IP allowlists. For new Prisma
deployments, enable the egress IP allowlist while onboarding the Global Protect mobile
users.
After you have added the egress IP addresses to your organization’s allow
lists, you return to the Prisma Access UI, confirm the GlobalProtect egress IP addresses
as being allow listed, and Push your changes. Prisma Access then
releases these egress IP addresses and adds them to your deployment. If Prisma Access
adds more IP addresses after initial configuration as a result of an autoscale event,
you confirm the new egress IP addresses as having been added before Prisma Access adds
them to your deployment.
Once enabled, the Egress IP Allowlists table provides information on the IP addresses
that are confirmed or yet to be confirmed, as well as their provision status.
Allow Listing GlobalProtect Mobile Users (Strata Cloud Manager)
Learn how to enable the egress IP allowlists for existing cloud managed mobile
users.
Enable Prisma Access to display the egress
IP addresses for Prisma Access traffic. Use these IP addresses in
the IP allow lists for your SaaS applications, where you’re restricting
usage to authorized users or sources.
- Go toWorkflowsPrisma Access SetupGlobalProtectInfrastructure and edit Prisma Access Locations settings.
- Display the IP addresses for Prisma Access locations.
- Enable Egress IP Allowlist to display the IP addresses for onboarded Prisma Access locations.
- Copy and add the allocated IP addresses to the allowlists of your SaaS applications.
- Migrate to confirm the IP addresses allocated for the onboarded locations in Prisma Access.
- Retrieve the IP addresses for new onboarded location or during an auto-scaling event.
- Select the Location name to find the new egress IP addresses allocated to the location.
- Select Confirmed adding to my IP Allowlist to add these IP addresses to the allowlists for your Saas applications before you confirm them in Prisma Access.If you have IPv6 addresses, select Confirmed adding to my IPv6 Allowlist.
- Push your changes to Prisma Access.
Statuses of Allocated Egress IP Addresses
The status column in the Egress IP Allowlists
indicates if all the allocated IP addresses for the locations are
provisioned for your deployment. Read on to learn about each status.
- Provisioned - You have added the egress IP addresses to the allowlists of your SaaS applications, confirmed the IP addresses in Prisma Access, and pushed your changes to make them fully provisioned.
- Partially Provisioned - You have added the first set of egress IP addresses, confirmed them in the Prisma Access, and pushed your changes. However, Prisma Access has added another set of IP addresses as part of an auto-scale event, and those IP addresses are not confirmed in Prisma Access.
- Not Provisioned - Prisma Access has allocated IP addresses for the location, and you have added the egress IP addresses to the allowlists of your SaaS applications and confirmed them in Prisma Access, but you have not yet onboarded this location.
- Cannot be Provisioned - You have onboarded this location, but have not yet confirmed in Prisma Access and pushed your changes.
The Egress IP Allowlists table also indicates the number
of IP addresses that are confirmed and yet to be confirmed in Prisma
Access. For example, 1/2 means, 1 out of 2 IP addresses allocated
for the location is confirmed in Prisma Access.

Allow Listing GlobalProtect Mobile Users (Panorama)
Learn how to enable the egress IP allowlists for existing Panorama managed mobile
users.
To enable you to add the public (egress) IP addresses for your GlobalProtect—Mobile
User deployment to any SaaS application allow lists you use within your
organization, Prisma Access provides the IP addresses and lets you verify
that you have added them to your allow list before using them in your
environment.
This method of egress IP address
allocation has the following benefits:
- It ensures that Prisma Access only provisions IP addresses that you have allow listed.
- It prevents mobile users from attempting to connect to Prisma Access from an IP address that is blocked by your organization’s network. Prisma Access does not release IP addresses to your deployment until they have been confirmed by you as allow listed.
- It provides a way to retrieve your current egress IP addresses without using the API.
Prisma
Access allocates egress IP addresses in the following situations:
- When you onboard your locations during mobile user onboarding.Prisma Access allocates two gateway IP addresses for each location you onboard.If you onboard a location, and other locations in the same compute location are experiencing an autoscale event, Prisma Access might allocate more than two IP addresses for the new location. In this situation, be sure that you add all these IP addresses to your allow lists and confirm all addresses as being Added to My Allow List.
- During a large scaling event.If the number of mobile users exceeds the capacity of the two pre-allocated IP addresses, Prisma Access allocates one more set of two IP addresses.Autoscale events affect all the onboarded locations in a compute location. When an autoscale event occurs for a location and you have not yet confirmed the addresses as being added to your allow lists, all locations in that compute location will show an Autoscale Status of Not Allowed.Autoscale Status shows the status of the autoscaling in Prisma Access.
- Allowed—You have added IP addresses to the allow lists. If a large number of mobile users log in to a single location and trigger an autoscale event, Prisma Access will use the allow listed IP addresses for the autoscale event.
- Not Allowed—You have not specified all IP addresses as being added to your allow lists in the Prisma Access UI, or you have not committed and pushed your changes after marking them as added. If Prisma Access triggers an autoscale event, Prisma Access will not provision more IP addresses to add more capacity for the location.Every time that you add a location, or every time that Prisma Access adds IP addresses as a result of an autoscale event, you need to refresh the page that contains the Egress IP Allow List table, specify Added to My Allow List to mark the IP addresses as being added to your organization’s allow lists, and Commit and Push your changes.
To keep informed of any IP addresses that Prisma Access adds as a result of an autoscale event, you can set up a URL where Prisma Access will notify you of IP address changes.
You
are not required to enable this functionality; you choose whether
or not to let Prisma Access release the IP addresses until you have
confirmed them as being allow listed in the UI.
To prevent Prisma Access from provisioning public (egress) GlobalProtect
IP addresses to your deployment until you have added them to your allow lists,
specify Yes in the Using IP Allow List in SaaS
Apps setting during Mobile Users—GlobalProtect onboarding. Confirm
that you have added them in the Prisma Access UI by completing the following
task.
- Select PanoramaCloud ServicesConfigurationMobile Users—GlobalProtect.
- Select your Hostname and Configure it (for an existing deployment), or Configure your deployment for the first time (for a new deployment).
- Specify Using IP Allow List in SaaS Apps as Yes.
- Continue your Prisma Access onboarding, including selecting the locations to use in your Mobile Users—GlobalProtect deployment, and Commit and Push your changes.It might take up to a minute for the changes to be reflected in the UI. If you view the Egress IP Allow List before committing and pushing your changes, it shows a status of 0/0 Egress IPs Confirmed Allow Listed, because Prisma Access has not assigned any egress IP addresses to your deployment.
- View the Egress IP Allow List table, and make a note of the egress IP addresses that need to be added to your allow lists.You can view the egress IP addresses in the Confirmed Allow Listed Egress IPs / Allocated field of the Egress IP Allow List table. The first number indicates whether or not the IP address has been confirmed as being added to your allow lists.The following example shows the IP addresses for the US Northeast location. The description of 0/2 Egress IPs Confirmed Allow Listed indicates that 0 of the two egress IP addresses have been marked as being added to your allow lists, and you need to add them.If you have a new Prisma Access deployment, or if you have added locations or had an autoscale event, the table shows that none of the egress IP addresses have been added to your organization’s allow list.If you have an existing Prisma Access deployment, the table shows a Provisioning Status of Provisioned and an Autoscale Status of Allowed, which indicates that Prisma Access marked the egress IP addresses as added.Prisma Access will allocate two addresses for each newly-added location. If an existing location has previously had an autoscale event when a large number of mobile users logged in to a single location at the same time, Prisma Access allocates additional egress IP address in multiples of two, and an existing location could have four or more addresses.
- Find the new egress IP addresses that need to be added to your organization’s allow lists by selecting the Location name in the table.
- Add these egress IP addresses to your organization’s allow lists.
- After you have allow listed the egress IP address, return to the egress IP area and indicate that you have added them to your allow lists by selecting Added to My Allow List.If you have IPv6 addresses, select IPv6 Address in the Allow Lists.
- Commit and push your changes to make them active in Prisma Access.
- Select CommitCommit and Push and Edit Selections in the Push Scope.
- Select Prisma Access, then make sure that Mobile Users is selected.
- Click OK to save your changes to the Push Scope.
- Commit and Push your changes.
If you view the Egress IP Allow List table before committing and pushing your changes, the Confirmed column shows a status of 0/0 Egress IPs Confirmed Allow Listed because Prisma Access has not assigned any IP addresses to your deployment until you Commit and Push.The Egress IP Allow List table contains the following additional fields:Field Description Location The onboarded mobile user location.Confirmed Allow Listed Egress IPs / Allocated The number of egress IP addresses that have been confirmed as being allow listed, and the number of egress IP addresses that have been allocated.Provisioning Status The allow listing status of the egress IP addresses.- Provisioned—You have added the egress IP addresses to your organization’s allow lists, have confirmed them as having been added in the Prisma Access UI by checking Added to My Allow List, and have committed and pushed your changes to make them fully provisioned.
- Not Provisioned—Prisma Access has allocated IP addresses for the location, and you have added the egress IP addresses to your organization’s allow lists and confirmed them as having been added in the Prisma Access UI, but you have not yet onboarded this location.
- Cannot Be Provisioned—You have onboarded this location, but have not yet checked Add to My Allow List and committed and pushed your changes.Until you specify in Prisma Access that you have added these egress IPs to your organization’s allow lists and Commit and Push your changes, Prisma Access will not provision these IP addresses to your deployment.
- Provisioned with partial capacity—You have added the first set of egress IP addresses, have confirmed them as having been added in the Prisma Access UI, and have Committed and Pushed your changes. However, Prisma Access has added another set of IP addresses as part of an autoscale event, and those IP addresses have not been specified as added to your allow lists in the Prisma Access UI.The following screenshot shows an example of a deployment that would be marked as Provisioned with partial capacity. Two IP addresses have been marked as Added to My Allow List; however, Prisma Access has added two more IP addresses to this location, and those locations have not been added in the UI.
Autoscale Status Shows the status of the autoscaling in Prisma Access.- Allowed—You have added IP addresses to the allow lists. If a large number of mobile users log in to a single location and trigger an autoscale event, Prisma Access will use the allow listed IP addresses for the autoscale event.
- Not Allowed—You have not specified all IP addresses as being added to your allow lists in the Prisma Access UI, or you have not committed and pushed your changes after marking them as added. If Prisma Access triggers an autoscale event, Prisma Access will not provision more IP addresses to add more capacity for the location.Every time that you add a location, or every time that Prisma Access adds IP addresses as a result of an autoscale event, you need to refresh the page that contains the Egress IP Allow List table, specify Added to My Allow List to mark the IP addresses as being added to your organization’s allow lists, and Commit and Push your changes.
To keep informed of any IP addresses that Prisma Access adds as a result of an autoscale event, you should set up a URL where Prisma Access will notify you of IP address changes.Timestamp The last known time when an IP was allocated for this region in Coordinated Universal Time (UTC).After you Commit and Push, the Confirmed column will show a status of 0/2 Egress IPs Confirmed Allow Listed, because you have not yet confirmed the IP addresses as having been allow listed in the Prisma Access UI.
When you onboard a mobile user location, Prisma Access provides you with
two egress IP addresses - one active IP address and one address to use in case of an
autoscale event. The following
provides examples of how Prisma Access allocates and provisions egress IP addresses
after an autoscale event.
Autoscale Event—If a large number of mobile users log in to a mobile user
location at the same time, that event might cause Prisma Access to allocate an
additional set of two egress IP addresses to accommodate the large number of users.
After you have allow listed the first two egress IP addresses, the status before an
autoscale event shows the two egress IP addresses as being allow listed with a
confirmed status of 2/2 Egress IPs Confirmed Allow Listed, a
provisioning status of Provisioned, and an autoscale status
of Allowed, as shown in the Hong Kong location in the
following screenshot.

If a large number of mobile users log in to the Hong Kong location at the same time,
Prisma Access makes the backup egress IP address active and allocates two more IP
addresses and makes one of them active. When an autoscale event occurs,
the egress IP addresses have been allocated but not provisioned, the confirmed
status is 2/4 Egress IPs Confirmed Allow Listed, and the
provisioning status shows Provisioned without enough
capacity. In addition, the autoscale status shows Not
Allowed, which means that Prisma Access will not provision the extra
egress IP address to your deployment if an autoscale event occurs.

After you have added the new egress IP addresses to your allow lists, select the
location name; then, select Added to My Allow List for the
two IP addresses that were added and Commit and Push your
changes.

When complete, the Hong Kong location shows that all four egress IP addresses are
confirmed and provisioned, and autoscaling is active.
