>
    Strata Copilot
    Bring Your Own IP
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access
    3. Prisma Access Administration
    4. Prisma Access Advanced Deployments
    5. Bring Your Own IP
    Download PDF
    Prisma Access

    Bring Your Own IP

    Table of Contents

    Bring Your Own IP

    Use your organization's existing public IP address ranges with Prisma Access instead of provider-assigned IPs, preserving your network policies and external allow lists.
    Where Can I Use This?What Do I Need?
    • Prisma Access (Managed by Strata Cloud Manager)
    • Prisma Access license
    • BYOIP add-on license
    • PAN-OS 10.2.10 or later
    • Prisma Agent 5.2.0 or later
    This is a Limited Availability release. To activate this functionality, reach out to your Palo Alto Networks account representative.
    Bring Your Own IP (BYOIP) is a deployment model that allows you to use IP address ranges your organization already owns and manages within a cloud-delivered service such as Prisma Access. Instead of using provider-assigned public IP addresses, you retain control of your existing IP space, preserving established network policies, security controls, and external allow lists.
    Adopting BYOIP offers the following advantages:
    • Minimize IP Allow Listing—Eliminate the need to update external allow lists when Prisma Access scales or changes IPs.
    • Avoid Disruptions—Prevent IP changes during autoscaling and upgrade events.
    • Enhance Trust—Maintain ownership of established, trusted IP ranges.
    • Build Stronger IP Reputation Management—Preserve the reputation history of your controlled IPs.
    Bring Your Own IP lets you provide your own public IP prefixes on a per-region basis. The region here refers to each edge and compute location.
    • Supports both IPv4 (minimum /24 per region) and IPv6 (/48 per region). Per region, you may configure IPv4 only, IPv6 only, or both.
    • Validates ownership through route origin authorization (ROA) and Registration Data Access Protocol (RDAP)/Pointer Record (PTR) verification.
    • Prefixes registered with cloud providers and managed by Palo Alto Networks.
    The BYOIP onboarding process typically takes 4 to 5 weeks. Each /24 subnet you own must be authorized by the cloud provider, Google Cloud Platform (GCP), a process that generally takes 3 to 4 weeks to complete. Palo Alto Networks performs the authorization for you, requiring no interaction between you and GCP. Once authorization is complete, you must provide a 6 to 8 hour maintenance window during which the Palo Alto Networks Site Reliability Engineering (SRE) team will replace the existing Prisma Access IP addresses with your own BYOIP address range.
    To configure BYOIP, complete the following steps.
    1. From Strata Cloud Manager, go to ConfigurationNGFW & Prisma AccessConfiguration ScopePrisma AccessSetup.
    2. Click the Bring Your Own IP settings gear.
      Existing regions are prepopulated; you can add further regions as needed. New regions must be added manually.
      For each region, you can configure IPv4 only, IPv6 only, or both IPv4 and IPv6.
    3. Add Region and complete the information:
      • Region Name: GCP location
      • IPv4 Details: Add IPv4 Subnets, and toggle to Authorize.
      • IPv6 Details: Add IPv6 Subnets, and toggle to Authorize.
      • Click Save.
      Existing regions with Palo Alto Networks IPs will continue to work. However, if you add a new region while onboarding, commit push fails with the error COIP provisioned tenant. First onboard the region in BYOIP.
      Security credentials are made available about an hour after you add the region subnets. The provisioning status then shows Ready to authorize.
    4. Download the security credentials and add them to the DNS PTR record for each region.
      For example:
      dig -x 100.x.x.1

; <<>> DiG 9.10.6 <<>> -x 100.x.x.1

;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31526
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;1.x.x.100.in-addr.arpa.	IN	PTR

;; ANSWER SECTION:
1.x.x.100.in-addr.arpa. 300	IN	PTR	pxxyyzz112233

;; Query time: 125 msec
;; SERVER: 10.x.x.x#xx(10.x.x.x)
;; WHEN: Mon Jul 06 17:03:33 CDT 2026
;; MSG SIZE  rcvd: 80
    5. After all DNS entries are in place, toggle the Authorize switch to Yes for each region.
    6. Push Config to push and commit your changes.
      GCP then validates the credentials, which takes three to four weeks.
      Contact your Palo Alto Networks Customer Success or Sales representative to schedule multiple maintenance windows to migrate one or a batch of regions instead of migrating all regions at once. During these windows, the Palo Alto Networks SRE team will replace existing Prisma Access IPs with your BYOIP address range. When completed, the provisioning status advances to IN_USE.
      The following table shows the Provisioning Status Reference.
      StatusDescription
      STARTYou have configured the IPv4/IPv6 prefix per region and pushed the config to the Prisma Access back-end.
      IN_PROGRESSPalo Alto Networks is retrieving security credentials from GCP and making them available for download.
      READY_TO_AUTHORIZESecurity credentials are ready. You can download them and toggle the Authorize switch.
      VALIDATINGPalo Alto Networks is validating the security credentials with GCP after you toggle Authorize to Yes.
      VALIDATED_AND_ONBOARDINGGCP validation succeeded. Palo Alto Networks is onboarding prefixes to the cloud provider and updating IPAM/global routing tables.
      PROVISIONEDIPv4 prefixes updated in IPAM and IPv6 provisioned successfully for deployments with existing instances.
      READY_TO_USERegion is ready for new firewall onboarding.
      IN_USEPrisma Access is actively using the prefixes after successful region migration.
      PENDING_DELETEDeletion flag set; entry will be removed once the deletion workflow completes.
      FAILEDGeneral failure during credential fetch or other operations.
      RETRY_AUTHGCP validation failed after retries. You must reconfigure and push again with Authorize enabled.
      CREDENTIAL_FETCH_FAILEDPalo Alto Networks failed to retrieve security credentials from GCP.

    Guidelines and Recommendations

    Use these following tips when configuring BYOIP.
    • You must migrate in batches to have a smooth transition for BYOIP across multiple geographic regions.
    • The remote network peers need to be configured using FQDNs rather than IP addresses. During the maintenance window, the Palo Alto Networks IP addresses will be swapped with your IP addresses, while the FQDNs will remain unchanged. After the IP address swap, the FQDNs resolve to the new IP addresses after a few DNS refreshes, allowing the tunnel to be reestablished.

    © 2026 Palo Alto Networks, Inc. All rights reserved.