If you are using a Palo Alto Networks firewall to secure traffic between Panorama, the firewalls, and Strata Logging Service, use the following table to identify the App-IDs and ports to which you must allow traffic to ensure that Panorama and the firewalls can successfully connect to Strata Logging Service:

For OCSP, you must also allow the firewalls to access ocsp.paloaltonetworks.com on port 80.

On firewalls running PAN-OS 9.1.7 or earlier, you also need a Security policy rule that allows SSL over port 444 to lic.lc.prod.us.cs.paloaltonetworks.com.

(PAN-OS 10.0 or later) If you are sending telemetry data to Strata Logging Service, then, in addition to the above App-IDs and ports (except paloalto-logging-service), you must allow the following:

Panorama and Palo Alto Networks firewalls need to access these FQDNs for the initial setup and one-time password, ongoing certificate revocation checks, and certificate renewals.

Additional region-specific FQDNs used by Panorama and Firewall to send logs to Strata Logging Service are available here. If you have another vendor's firewall in between your Palo Alto Networks firewall and Strata Logging Service, allow traffic to the FQDNs and ports for your Strata Logging Service region.