>
    Strata Copilot
    Verify CDSS Service Connectivity
    Focus
    Download PDF
    Focus
    1. Home
    2. FedRAMP
    3. Network Security FedRAMP
    4. NGFW (Hardware and VM) FedRAMP Moderate and High Requirements
    5. FedRAMP High CDSS Single SKU
    6. Verify CDSS Service Connectivity
    Download PDF
    FedRAMP

    Verify CDSS Service Connectivity

    Table of Contents

    Verify CDSS Service Connectivity

    Verify that your NGFW can reach FedRAMP High CDSS services after license activation.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by Strata Cloud Manager)
    • NGFW (Managed by PAN-OS or Panorama)
    • FedRAMP High CDSS licenses activated
    • FedRAMP High FQDNs allowed in your security policy
    After you activate your FedRAMP High CDSS licenses, verify that the NGFW can connect to FedRAMP High cloud services. Connectivity failures may indicate missing FQDNs in your security policy or incorrect network routing. For the complete list of required domains, see FedRAMP High FQDNs.
    1. Verify Advanced WildFire connectivity.
      1. Log in to the NGFW CLI.
      2. Run the following command:
        show wildfire status
        Confirm that the Cloud Connection field shows Connected and the server address resolves to a FedRAMP High Advanced WildFire domain (gov-cloud.wildfire.paloaltonetworks.com or govgvs.wildfire.paloaltonetworks.com).
    2. Verify Advanced DNS Security domain resolution.
      1. Run the following command:
        show dns-proxy fqdn all
        Confirm that the FedRAMP High DNS Security domain resolves and returns valid IP addresses.
    3. Verify connectivity for all other CDSS services.
      1. Run the following command:
        show ctd-agent status security-client
        Confirm the status shows Connected for all security client services, and verify the connected domain is a FedRAMP High PAN-OS Cloud Component domain (for example, gov-hawkeye.services-edge.paloaltonetworks.com).
    4. If a service shows as disconnected, verify the following:
      1. Confirm the corresponding domain is allowed in your security policy and reachable from the NGFW management interface.
      2. Confirm DNS resolution is functioning correctly by running:
        ping host <fqdn>

    © 2026 Palo Alto Networks, Inc. All rights reserved.