Prisma Agent FQDNs and Ports
Add the required Prisma Agent FQDNs and ports to your firewall's allow list
so endpoints can connect to the Endpoint Manager, gateways, and Palo Alto Networks
services.
| Where Can I Use This? | What Do I Need? |
|---|
- Prisma Access (Managed by Strata Cloud Manager)
- Prisma Access (Managed by Panorama)
- NGFW (Managed by Panorama)
|
- Check the prerequisites for the deployment you're
using
- Contact your Palo Alto Networks account representative to activate the Prisma Agent feature
|
To ensure Prisma Agent can establish and maintain connections, configure your
network firewall to allow outbound traffic to the following FQDNs and ports.
Endpoint Manager
The Endpoint Manager (EPM) is the service that manages enrollment, authentication,
and communication for Prisma Agent endpoints. Allow outbound traffic to the
following FQDN:
| FQDN | Port |
|---|
| <tenant>.epm.gpcloudservice.com | 443 |
Portal Authentication
If you use LDAP authentication, the agent authenticates users through a
GlobalProtect portal instead of Cloud Identity Engine. Allow outbound traffic
to the following GlobalProtect portal endpoints:
| FQDN | Port |
|---|
| <portal-fqdn>/global-protect/prelogin.esp | 443 |
| <portal-fqdn>/global-protect/getconfig.esp | 443 |
Cloud Identity Engine Authentication
If you use Cloud Identity Engine for user authentication, allow outbound HTTPS
traffic (port 443) to the CIE authentication URLs for your region on your network
firewalls and proxies. CIE makes authentication calls during both initial user logon
and the transition from a pre-logon tunnel to a user-specific tunnel. Blocking these
URLs prevents the agent from completing the transition to a user-specific
connection.
For the complete list of region-based CIE authentication URLs and the IdP URLs your
identity provider requires, see
Configure Cloud Identity Engine
Authentication. If you don't need to restrict traffic to a specific
region, allow outbound traffic to
*.apps.paloaltonetworks.com.
Gateways
Allow outbound traffic to your gateway FQDN on port 443 for SSL tunnel connections,
and on the dynamic ESP port specified in your gateway configuration.
Certificate Validation (OCSP and CRL)
The agent validates certificates for the Endpoint Manager, gateways, and other
services using Online Certificate Status Protocol (OCSP) and Certificate Revocation
Lists (CRL). The specific OCSP responder and CRL distribution point URLs are
embedded in each certificate and vary by certificate authority. Allow outbound
traffic on the following ports for certificate validation:
| Protocol | Ports |
|---|
| OCSP | TCP 80, TCP 443 |
| CRL | TCP 80, TCP 443, TCP 389 (LDAP) |
Default Bypass Host
The agent designates storage.googleapis.com as a default bypass
host, routing traffic to this domain directly through the local network instead of
the tunnel. This domain is required to download Prisma Agent software images and
OPSWAT binary updates, submit HIP reports, and retrieve remote diagnostic logs.
Allow outbound traffic to storage.googleapis.com on port
443.
DNS
The agent's embedded browser uses Google DNS for domain resolution. Allow outbound
DNS over HTTPS (DoH) traffic to 8.8.8.8 on TCP port 443.
Static URLs
Allow outbound traffic to the following Palo Alto Networks URLs:
| URL | Purpose |
|---|
| docs.paloaltonetworks.com | Support documentation |
| www.paloaltonetworks.com | Privacy policy |
| filter.paloaltonetworks.com | Network extension server address |
Required Ports
| Port | Purpose |
|---|
| 443 | HTTPS — Endpoint Manager, gateways, SSL tunnel |
| 80 | HTTP — captive portal detection |
| 4501 | MFA listening port |
| 9999+ | Local proxy — starts at port 9999 |
