Prisma Access
Allow Listing GlobalProtect Mobile Users (Strata Cloud Manager)
Table of Contents
Allow Listing GlobalProtect Mobile Users (Strata Cloud Manager)
Learn how to find the IP addresses that you need to add to your network's allow lists.
Enable Prisma Access to display the egress
IP addresses for Prisma Access traffic. Use these IP addresses in
the IP allow lists for your SaaS applications, where you’re restricting
usage to authorized users or sources.
- Go to and edit Prisma Access Locations settings.
- Display the IP addresses for Prisma Access locations.
- Enable Egress IP Allowlist to display the IP addresses for onboarded Prisma Access locations.
- Copy and add the allocated IP addresses to the allowlists of your SaaS applications.
- Migrate to confirm the IP addresses allocated for the onboarded locations in Prisma Access.
- Retrieve the IP addresses for a newly-onboarded location or during an auto-scaling event.
- Select the Location name to find the new egress IP addresses allocated to the location.
- Select Confirmed adding to my IP Allowlist to add these IP addresses to the allow lists for your SaaS applications before you confirm them in Prisma Access.
If you have IPv6 addresses, select Confirmed adding to my IPv6 Allowlist.
- Push your changes to Prisma Access.
Statuses of Allocated Egress IP Addresses
The status column in the Egress IP Allowlists
indicates if all the allocated IP addresses for the locations are
provisioned for your deployment. Read on to learn about each status.
- Provisioned—You have added the egress IP addresses to the allowlists of your SaaS applications, confirmed the IP addresses in Prisma Access, and pushed your changes to fully provision them.
- Partially Provisioned—You have added the first set of egress IP addresses, confirmed them in the Prisma Access, and pushed your changes. However, Prisma Access has added another set of IP addresses as part of an autoscale event, and those IP addresses are not yet confirmed in Prisma Access.
- Not Provisioned—Prisma Access has allocated IP addresses for the location, and you have added the egress IP addresses to the allow lists of your SaaS applications and confirmed them in Prisma Access, but you have not yet onboarded this location.
- Cannot be Provisioned—You have onboarded this location, but have not yet confirmed in Prisma Access and pushed your changes.
The Egress IP Allowlists table also indicates the number of IP addresses that are confirmed and
not yet confirmed in Prisma Access. For example, 1/2 means, 1 out of 2 IP
addresses allocated for the location are confirmed in Prisma Access.
