>
    Strata Copilot
    IP Capacity Planning
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access
    3. Prisma Access Administration
    4. Prisma Access Mobile Users
    5. Mobile Users: GlobalProtect
    6. IP Capacity Planning
    Download PDF
    Prisma Access

    IP Capacity Planning

    Table of Contents

    IP Capacity Planning

    Allocate public IP addresses for Mobile Users—GlobalProtect deployments based on the location and number of users.
    Where Can I Use This?What Do I Need?
    • Prisma Access (Managed by Strata Cloud Manager)
    • A minimum version of Prisma Access 6.0 (new deployments and existing deployments that have not yet onboarded Mobile Users—GlobalProtect™ only)
    • IP Optimization is required
    To activate this functionality, reach out to your Palo Alto Networks account representative.
    IP capacity planning streamlines the Prisma Access tenant onboarding process by automating and simplifying egress IP address capacity planning for Mobile Users—GlobalProtect deployments. You can quickly allocate egress IP addresses for your mobile users based on the location and number of mobile users, significantly reducing the time it takes to allow list the public IP addresses in your network. You can use the workflow to add locations individually or through bulk upload, visualizing your global deployment on an interactive map, and automatically suggesting optimal Prisma® Access locations based on your input. You can easily review and adjust these recommendations, ensuring that your deployment aligns with your specific needs.
    Prisma Access allocates two egress IP addresses for every 5,000 users; if you add more users, Prisma Access adds more IP addresses. You can then add these IP addresses to your organization's allow lists.
    The IP address capacity planner also offers a comprehensive view of your egress IP address allocations and user distributions, enabling you to make informed decisions about your network resources. By using this feature, you can expedite your Prisma Access deployment, and ensure a smooth end-user experience. The automated process lets you optimize your deployment and make it easier to scale your network as your needs evolve. This feature is valuable if you have a large, geographically diverse user base or need to frequently adjust your network capacity to meet changing demands.
    This functionality is supported for new Prisma Access Mobile Users—GlobalProtect deployments and existing Prisma Access deployments that have not yet started the process to onboard GlobalProtect mobile users.
    IPv6 is not supported.
    Before you start to allocate IP addresses, make sure that you have a comprehensive list of cities and estimated user counts before beginning the process.
    IP capacity planning requires that IP Optimization be enabled.
    1. Go to ConfigurationNGFW and Prisma AccessConfiguration ScopePrisma AccessMobile Users.
    2. Click the gear in Egress IP Planning.
    3. Add the information and enter the city closest to the mobile users and the number of users.
      Prisma Access populates the zip code and displays the city on a map.
      Alternatively, you can enter cities and users with a CSV Bulk Update using a .csv file. To do this, Download CSV Template File, and enter this information in the ZIP file with the information delineated with commas:
      • The two-letter country code.
        Prisma Access uses the ISO 3166-1 standard for the country code.
      • The city's ZIP code.
        Prisma Access uses the ZIP code standard based on the country in which the city resides.
      • The number of users.
      Here's an example of a correctly formatted .csv file: 
      Country,Zip Code,Estimated Users
US,97204,200
US,95050,200
GB,WC2N 5DS,200
IN,400070,200
      When complete, drag and drop the file, or Browse File and select it on your computer.
      Prisma Access shows that the locations are successfully added.
    4. Perform the Mapping to Prisma Access Location.
      Prisma Access provides you with the recommended Prisma Access locations to use for each location you specified.
    5. (Optional) If you want to change the default Prisma Access Location, select another location.
    6. Go to the Final Confirmation.
    7. Confirm the Prisma Access locations and the number of users.
    8. Allocate Egress IPs.
    9. Make a note of the Egress IP addresses, or Copy Egress IPs, and add these IP addresses to your organization's allow lists.
      Prisma Access does not always have a one-to-one mapping from the cities and users you specify to the IP addresses. For example, if you specify 250 users in Portland, Oregon and 250 users in Gresham, Oregon, Prisma Access can assign a location of US Northwest and use the same egress IP address for those combined locations.
    10. (Optional) If you need to make changes, Edit Egress IP Planning and change the locations as needed.
    11. (Optional) Confirm that the IP addresses have been added to your allow lists.

    © 2026 Palo Alto Networks, Inc. All rights reserved.