Pre-Allocate IP Addresses for Prisma Access Mobile User Locations

Pre-Allocate IP Addresses for Prisma Access Mobile User Locations

1. Retrieve the Prisma Access API key.
2. Pre-allocate the mobile user egress IP addresses by creating a .txt file and specifying the following options in the .txt file you create.

   Enter the following text in the .txt file:

   • Mobile Users—GlobalProtect Deployments:

       {
        "actionType": "pre_allocate",   
        "serviceType": "gp_gateway",
        "location": ["location"]
        }

   • Mobile Users—Explicit Proxy Deployments:

     {
     "actionType": "pre_allocate",
     "serviceType": "swg_proxy",
     "location": ["location"]}

   Where location is the Prisma Access location or locations where you want to pre-allocate the IP addresses. If you enter multiple locations, use brackets around the set of locations and separate each location entry with quotes, a comma, and a space (for example, ["location1", "location2", "location3"], and so on).

   Enter a maximum of 12 locations. Entering more than 12 locations might cause timeout errors when Prisma Access retrieves the pre-allocated IP addresses.
3. Enter the CURL command as shown in Step 3 in Run the API Script Used to Retrieve Prisma Access IP Addresses.
4. Retrieve the IP addresses and subnets you requested, including their validity period, by re-opening the .txt file, removing the existing information, and editing it.

   • Mobile Users—GlobalProtect Deployments:
     • To retrieve all pre-allocated IP addresses, enter the following text in the .txt file.

         {
          "serviceType": "all",   
          "addrType": "pre_allocated",
          "location": "all"
          }

     • To retrieve all pre-allocated IP addresses for Prisma Access portals for a given location, enter the same information in the .txt file but substitute “all” with “gp_portal” in the .txt file.
   • Mobile Users—Explicit Proxy Deployments:
     To pre-allocate all IP addresses you need to add to allow lists for an explicit proxy deployment, enter the following text in the .txt file.

     {
     "actionType": "pre_allocate",
     "serviceType": "swg_proxy",
     "location": ["all"]
     }

   Palo Alto Networks recommends that you enter all so you can retrieve all required pre-allocated egress IP addresses to add to your allow lists.

   For Mobile Users—GlobalProtect deployments, while Prisma Access returns up to four addresses for each location (two gateway IP addresses and, if required, two portal IP addresses), the API command can return a large amount of information. To make the output more readable, if you have Python installed, you can add | python -m json.tool at the end of the CURL command.
5. Re-enter the CURL command as shown in Step 3 in Run the API Script Used to Retrieve Prisma Access IP Addresses to retrieve the pre-allocated addresses.

   Prisma Access returns the information in the following format:

       "result": [
          {
               "zone": "prisma-access-zone1",
               "addresses": [
     ["ip-address1","ip-address2"]
               "zone_subnet" :  
     [subnet-and-mask1","subnet-and-mask2"]
               "address_details":[
                             {"address":"ip-address1",
                              "service_type":"service-type",                         
                               "addressType":"pre-allocated",
                              "expiring_in" : "validity-period" },
                             {"address":"ip-address2",
                              "service_type":"gp_gateway",
                              "addressType":"pre-allocated",
                              "validity_period_remaining" : "90 days" } ,        
            },        

   Where the variables represent the following API command output:

   Variable	Explanation
   prisma-access-zone1	The Prisma Access location for which pre-allocated IP addresses were retrieved.
   ip-address1 and ip-address2	The egress IP addresses that Prisma Access has pre-allocated for the specified location. Prisma Access retrieves two IP addresses for each location; you must add both of these IP addresses to your allow lists.
   subnet-and-mask1 and subnet-and-mask2	The subnets that Prisma Access has pre-allocated and reserved for the egress IP addresses in your deployment.
   service-type	The type of the pre-allocated egress IP address (either gp_portal for a Prisma Access portal or gp_gateway for a Prisma Access gateway).
   validity-period	The remaining time, in days, for which the pre-allocated IP address is valid. You must onboard your mobile user location before the IP addresses’ validity period ends. If the pre-allocated IP addresses expire, you can rerun the API script to retrieve another set of pre-allocated IP addresses.

   You could receive an error if you attempt to pre-allocate IP addresses for locations that meet one of the following criteria:

   • You have already onboarded the location.
   • You onboarded, then deleted the location.
     In this case, enter the following text in the .txt file to retrieve the Mobile Users—GlobalProtect IP addresses for the location:

       {
     "serviceType": "gp_gateway",
     "addrType": "all",
     "location": "all"
        }

   • You have reached the maximum number of mobile user locations allowed by your license and cannot add any more locations.
   • You entered the location name incorrectly.
   • You entered a serviceType other than gp_gateway.
   • you entered an actionType other than pre_allocate.