Retrieve the IP Addresses for Prisma Access
Table of Contents
Expand All
|
Collapse All
Prisma Access Docs
-
5.2 Preferred and Innovation
- 5.2 Preferred and Innovation
- 5.1 Preferred and Innovation
- 5.0 Preferred and Innovation
- 4.2 Preferred
- 4.1 Preferred
- 4.0 Preferred
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
-
-
-
-
- Allocate Licenses for Prisma Access (Managed by Strata Cloud Manager)
- Plan Service Connections for Prisma Access (Managed by Strata Cloud Manager) and Add-ons
- Add Additional Locations for Prisma Access (Managed by Strata Cloud Manager) and Add-ons
- Enable Available Add-ons for Prisma Access (Managed by Strata Cloud Manager)
- Enable Dynamic Privilege Access for Prisma Access (Managed by Strata Cloud Manager)
- Search for Subscription Details
- Share a License for Prisma Access (Managed by Strata Cloud Manager) and Add-ons
- Increase Subscription Allocation Quantity
-
- Activate a License for Prisma Access (Managed by Strata Cloud Manager) and Prisma SD-WAN Bundle
-
- Onboard Prisma Access
-
3.1 Preferred and Innovation
- 4.0 & Later
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
- Prisma Access China
-
- Prisma Access
- Prisma Access Infrastructure Management
- Cadence for Software and Content Updates for Prisma Access
- Use the Prisma Access App to Get Upgrade Alerts and Updates
- View Prisma Access Software Versions
-
- Determine Your Prisma Access License Type from Panorama
- Cheat Sheet: Integrate ADEM with Panorama Managed Prisma Access
- Cheat Sheet: Integrate IoT Security with Panorama Managed Prisma Access
- Cheat Sheet: Enterprise DLP on Panorama Managed Prisma Access
- Visibility and Monitoring Features in the Prisma Access App
- Monitor Your Prisma Access Data Transfer Usage
- Zone Mapping
- Prisma Access APIs
- Prisma Access Deployment Progress and Status
- Troubleshoot the Prisma Access Deployment
-
- Prisma Access Mobile User Deployments
- How the GlobalProtect App Selects a Prisma Access Location for Mobile Users
- Integrate Prisma Access with On-Premises Gateways
-
- Set Equal Gateway Priorities for On-Premises and Prisma Access Gateways
- Set a Higher Gateway Priority for an On-Premises Gateway
- Set Higher Priorities for Multiple On-Premises Gateways
- Configure Priorities for Prisma Access and On-Premises Gateways
- Allow Mobile Users to Manually Select Specific Prisma Access Gateways
- Report Prisma Access Website Access Issues
-
- Multitenancy Overview
- Multitenancy Configuration Overview
- Plan Your Multitenant Deployment
- Create an All-New Multitenant Deployment
- Enable Multitenancy and Migrate the First Tenant
- Add Tenants to Prisma Access
- Delete a Tenant
- Create a Tenant-Level Administrative User
- Sort Logs by Device Group ID in a Multitenant Deployment
-
-
-
- Default Routes With Prisma Access Traffic Steering
- Traffic Steering in Prisma Access
- Traffic Steering Requirements
- Default Routes with Traffic Steering Example
- Default Routes with Traffic Steering Direct to Internet Example
- Default Routes with Traffic Steering and Dedicated Service Connection Example
- Prisma Access Traffic Steering Rule Guidelines
- Configure Zone Mapping and Security Policies for Traffic Steering Dedicated Connections
- Configure Traffic Steering in Prisma Access
-
-
- Integrate Prisma Access With Other Palo Alto Networks Apps
- Integrate Third-Party Enterprise Browser with Explicit Proxy
-
-
- Connect your Mobile Users in Mainland China to Prisma Access Overview
- Configure Prisma Access for Mobile Users in China
- Configure Real-Name Registration and Create the VPCs in Alibaba Cloud
- Attach the CEN and Specify the Bandwidth
- Create Linux Instances in the Alibaba Cloud VPCs
- Configure the Router Instances
- Onboard the GlobalProtect Gateway and Configure the Prisma Access Portal
-
-
-
- INC_CIE_AGENT_DISCONNECT
- INC_CIE_DIRECTORY_DISCONNECT
- INC_GLOBALPROTECT_GW_USER_AUTH_ TIMEOUT_FAILURES_COUNT_EXCEEDED_ ABOVE_BASELINE_ALL_PA_LOCATIONS
- INC_GLOBALPROTECT_GW_USER_AUTH_ TIMEOUT_FAILURES_COUNT_EXCEEDED_ ABOVE_BASELINE_PER_PA_LOCATION
- INC_GLOBALPROTECT_PORTAL_AUTH_ TIMEOUT_FAILURES_COUNT_EXCEEDED_ ABOVE_BASELINE_ALL_PA_LOCATIONS
- INC_GLOBALPROTECT_PORTAL_AUTH_ TIMEOUT_FAILURES_COUNT_EXCEEDED_ ABOVE_BASELINE_PER_PA_LOCATION
- INC_PORTAL_CLIENTLESS_VPN_AUTH_ TIMEOUT_FAILURES_COUNT_EXCEEDED_ ABOVE_BASELINE_ALL_PA_LOCATIONS
- INC_PORTAL_CLIENTLESS_VPN_AUTH_ TIMEOUT_FAILURES_COUNT_EXCEEDED_ ABOVE_BASELINE_PER_PA_LOCATION
- INC_MU_AUTH_SERVER_UNREACHABLE_ALL_ PA_LOCATIONS
- INC_MU_AUTH_SERVER_UNREACHABLE_PER_ PA_LOCATION
- INC_MU_DNS_SERVER_UNREACHABLE_ALL_ PA_LOCATIONS
- INC_MU_DNS_SERVER_UNREACHABLE_ PER_PA_LOCATION
- INC_RN_AUTH_SERVER_UNREACHABLE_ALL_ PA_LOCATIONS
- INC_RN_AUTH_SERVER_UNREACHABLE_PER_ PA_LOCATION
- INC_RN_DNS_SERVER_UNREACHABLE_ALL_ PA_LOCATIONS
- INC_RN_DNS_SERVER_UNREACHABLE_PER_ PA_LOCATION
- INC_RN_ECMP_TUNNEL_RTT_EXCEEDED_ BASELINE
- INC_RN_PRIMARY_WAN_TUNNEL_RTT_ EXCEEDED_BASELINE
- INC_RN_SECONDARY_TUNNEL_DOWN
- INC_RN_SECONDARY_WAN_TUNNEL_RTT_ EXCEEDED_BASELINE
- INC_RN_SITE_CAPACITY_PREDICTION
- INC_SC_PRIMARY_WAN_TUNNEL_RTT_ EXCEEDED_BASELINE
- INC_SC_SECONDARY_WAN_TUNNEL_RTT_ EXCEEDED_BASELINE
- INC_SC_SITE_CAPACITY_PREDICTION
-
- INC_CERTIFICATE_EXPIRY
- INC_GP_CLIENT_VERSION_UNSUPPORTED
- INC_MU_IP_POOL_BLOCK_UTILIZATION_ EXCEEDED_CAPACITY
- INC_MU_IP_POOL_BLOCK_UTILIZATION_ EXCEEDED_THRESHOLD
- INC_PA_INFRA_DEGRADATION
- INC_PA_SERVICE_DEGRADATION_PA_LOCATION
- INC_PA_SERVICE_DEGRADATION_RN_ SITE_CONNECTIVITY
- INC_PA_SERVICE_DEGRADATION_SC_ CONNECTIVITY
- INC_RN_ECMP_BGP_DOWN
- INC_RN_ECMP_BGP_FLAP
- INC_RN_ECMP_PROXY_TUNNEL_DOWN
- INC_RN_ECMP_PROXY_TUNNEL_FLAP
- INC_RN_ECMP_TUNNEL_DOWN
- INC_RN_ECMP_TUNNEL_FLAP
- INC_RN_PRIMARY_WAN_BGP_FLAP
- INC_RN_PRIMARY_WAN_PROXY_TUNNEL_DOWN
- INC_RN_PRIMARY_WAN_PROXY_TUNNEL_FLAP
- INC_RN_PRIMARY_WAN_TUNNEL_DOWN
- INC_RN_PRIMARY_WAN_TUNNEL_FLAP
- INC_RN_SECONDARY_WAN_BGP_DOWN
- INC_RN_SECONDARY_WAN_BGP_FLAP
- INC_RN_SECONDARY_WAN_PROXY_TUNNEL_DOWN
- INC_RN_SECONDARY_WAN_PROXY_TUNNEL_FLAP
- INC_RN_SECONDARY_WAN_TUNNEL_DOWN
- INC_RN_SECONDARY_WAN_TUNNEL_FLAP
- INC_RN_SITE_DOWN
- INC_RN_SITE_LONG_DURATION_CAPACITY_ EXCEEDED_THRESHOLD
- INC_RN_SITE_LONG_DURATION_EXCEEDED_ CAPACITY
- INC_RN_SPN_LONG_DURATION_CAPACITY_EXCEEDED _THRESHOLD
- INC_RN_SPN_LONG_DURATION_EXCEEDED_ CAPACITY
- INC_SC_PRIMARY_WAN_BGP_DOWN
- INC_SC_PRIMARY_WAN_BGP_FLAP
- INC_SC_PRIMARY_WAN_PROXY_TUNNEL_DOWN
- INC_SC_PRIMARY_WAN_PROXY_TUNNEL_FLAP
- INC_SC_PRIMARY_WAN_TUNNEL_DOWN
- INC_SC_PRIMARY_WAN_TUNNEL_FLAP
- INC_SC_SECONDARY_WAN_BGP_DOWN
- INC_SC_SECONDARY_WAN_BGP_FLAP
- INC_SC_SECONDARY_WAN_PROXY_TUNNEL_DOWN
- INC_SC_SECONDARY_WAN_PROXY_TUNNEL_FLAP
- INC_SC_SECONDARY_WAN_TUNNEL_DOWN
- INC_SC_SECONDARY_WAN_TUNNEL_FLAP
- INC_SC_SITE_DOWN
- INC_SC_SITE_LONG_DURATION_CAPACITY_ EXCEEDED_THRESHOLD
- INC_SC_SITE_LONG_DURATION_EXCEEDED_ CAPACITY
- INC_ZTNA_CONNECTOR_APP_STATUS_DOWN
- INC_ZTNA_CONNECTOR_APP_STATUS_DOWN_PARTIAL
- INC_ZTNA_CONNECTOR_CPU_HIGH
- INC_ZTNA_CONNECTOR_MEMORY_HIGH
- INC_ZTNA_CONNECTOR_TUNNEL_DOWN
-
- AL_CIE_AGENT_DISCONNECT
- AL_CIE_DIRECTORY_DISCONNECT
- AL_MU_IP_POOL_CAPACITY
- AL_MU_IP_POOL_USAGE
- AL_RN_ECMP_BGP_DOWN
- AL_RN_ECMP_BGP_FLAP
- AL_RN_PRIMARY_WAN_BGP_DOWN
- AL_RN_PRIMARY_WAN_BGP_FLAP
- AL_RN_PRIMARY_WAN_TUNNEL_DOWN
- AL_RN_PRIMARY_WAN_TUNNEL_FLAP
- AL_RN_SECONDARY_WAN_BGP_DOWN
- AL_RN_SECONDARY_WAN_BGP_FLAP
- AL_RN_SECONDARY_WAN_TUNNEL_DOWN
- AL_RN_SECONDARY_WAN_TUNNEL_FLAP
- AL_RN_SITE_DOWN
- AL_RN_SITE_LONG_DURATION_CAPACITY_ EXCEEDED_THRESHOLD
- AL_RN_SITE_LONG_DURATION_EXCEEDED_ CAPACITY
- AL_RN_SPN_LONG_DURATION_CAPACITY_ EXCEEDED_THRESHOLD
- AL_SC_PRIMARY_WAN_BGP_DOWN
- AL_SC_PRIMARY_WAN_BGP_FLAP
- AL_SC_PRIMARY_WAN_TUNNEL_DOWN
- AL_SC_PRIMARY_WAN_TUNNEL_FLAP
- AL_SC_SECONDARY_WAN_BGP_DOWN
- AL_SC_SECONDARY_WAN_BGP_FLAP
- AL_SC_SECONDARY_WAN_TUNNEL_DOWN
- AL_SC_SECONDARY_WAN_TUNNEL_FLAP
- AL_SC_SITE_DOWN
- AL_SC_SITE_LONG_DURATION_CAPACITY_ EXCEEDED_THRESHOLD
- AL_SC_SITE_LONG_DURATION_EXCEEDED_CAPACITY
- AL_ZTNA_CONNECTOR_APP_STATUS_DOWN
- AL_ZTNA_CONNECTOR_APP_STATUS_DOWN_PARTIAL
- AL_ZTNA_CONNECTOR_CPU_HIGH
- AL_ZTNA_CONNECTOR_MEMORY_HIGH
- AL_ZTNA_CONNECTOR_TUNNEL_DOWN
- New Features in Incidents and Alerts
- Known Issues
Retrieve the IP Addresses for Prisma Access
Learn about the infrastructure IP addresses that are
used with Prisma Access and how to retreive them using the API command.
If you are manually adding IP addresses of your Prisma
Access infrastructure to an allow list in your network, or if you
are using an automation script to enforce IP-based restrictions
to limit inbound access to enterprise applications, you should understand
what these addresses do and why you need to allow them, as well as
the tasks you perform to retrieve them.
Prisma Access does not provision these IP addresses until after
you complete your Prisma Access configuration. After your deployment
is complete, you retrieve these IP addresses using an
API script
. The API script uses
an API key that you obtain from the Prisma Access UI and a .txt
file you create which specifies the addresses you want to retrieve.If you have a Mobile Users—GlobalProtect deployment, you
can use the Prisma
Access UI instead of this API to manage public IP address allocation
and confirm that the IP addresses have been added to your allow
lists before Prisma Access releases the IP addresses. In this way,
Prisma Access only provisions the IP addresses that you have allow
listed.
The following table provides you with a list of the IP address
that Prisma Access uses for each deployment type, along with the
keyword you use when you run the API script to
retrieve the IP addresses, and describes whether or not you should
add them to your organization’s allow lists.
Deployment Type | IP Address Type | Description |
---|---|---|
Mobile Users—GlobalProtect | Prisma Access gateway (gp_gateway) | Gateway IP addresses. You must add both
gateway and portal IP addresses to allow lists for your mobile user deployments. Mobile
users connect to a Prisma Access gateway to access internal or internet resources,
such as SaaS or public applications, for which you have provided access. For
mobile users, during initial deployment, Prisma Access assigns two
IP addresses for each location you deploy. |
Prisma Access portal (gp_portal) | Portal IP addresses. You must add both gateway
and portal IP addresses to allow lists for your mobile user deployments. Mobile
users log in to the Prisma Access portal to receive their initial
configuration and gateway location. | |
Loopback IP addresses | The source IP address used by Prisma Access
for requests made to an internal source, and is assigned from the infrastructure subnet.
Add the loopback IP address to an allow list in your network to
give Prisma Access access to internal resources such as RADIUS or
Active Directory authentication servers. Palo Alto Networks recommends
that you allow all the IP addresses of the entire infrastructure
subnet in your network, because loopback IP addresses can change.
To find the infrastructure subnet, select PanoramaCloud ServicesStatusNetwork DetailsService Infrastructure.
The subnet displays in the Infrastructure Subnet area. To
retrieve loopback IP addresses, use the legacy API
script. | |
Mobile Users—Explicit Proxy | Authentication Cache Service (ACS) | The address for the Prisma Access service
that stores the authentication state of the explicit proxy users. This
address is only used for explicit proxy for
mobile users. |
Network Load Balancer | The address that Prisma Access uses for
the explicit proxy network load balancer. This address is
only used for explicit proxy for
mobile users. | |
Remote Network | Remote Network IP addresses (remote_network) | The Service IP Addresses that Prisma
Access assigns for the Prisma Access remote network connection,
and egress IP addresses that Prisma
Access uses to make sure that remote network users get the correct
default language for their region. Add these addresses to allow
lists in your network to give Prisma Access access to internet resources. |
Loopback IP addresses | The source IP address used by Prisma Access
for requests made to an internal source, and is assigned from the infrastructure subnet.
Add the loopback IP address to an allow list to give Prisma Access access
to internal resources such as RADIUS or Active Directory authentication servers.
To retrieve loopback IP addresses, use the legacy API
script. | |
Clean Pipe | Clean Pipe IP Addresses (clean_pipe) | Add these IP addresses to an allow list to give the Clean Pipe service access to internet resources. |
Loopback IP addresses | The source IP address used by Prisma Access
for requests made to an internal source, and is assigned from the infrastructure subnet.
Add the loopback IP address to an allow list to give Prisma Access access
to internal resources such as RADIUS or Active Directory authentication servers.
To retrieve loopback IP addresses, use the legacy API
script. |
Run the API Script Used to Retrieve Prisma Access IP Addresses
Use the API script described here to retrieve the IP
addresses that are required for your deployment.
Prisma Access provides an API script that
you can use to retrieve the public and private IP addresses it uses in its
infrastructure. If you need to add public IP addresses to
allow lists in your organization’s network, use the following steps
to retrieve these IP addresses with the API script.
This
command does not retrieve loopback addresses; to retrieve loopback
IP addresses, use the legacy API.
- Get the API key.You need this key to authenticate to Prisma Access and retrieve the list of IP addresses using the API command. Only a Panorama administrator or Superuser can generate or access this API key.
- Select PanoramaCloud ServicesConfigurationService Setup.
- Select Generate API Key.If you have already generated an API key, the Current Key displays. If you haven’t yet generated a key or want to replace the existing key to meet audit or compliance check for key rotation, click Generate New API Key for a new key.
- Create a .txt file and put the API command options in the file.Using the API the command to use is a two-step process. First, you create a .txt file, specifying the parameters for the IP addresses to retrieve, and save the file in a folder that is reachable from the location where you run the command. Then, you run the API and specify the name and location of the .txt file you created in the command.Specify the following keywords and arguments in the .txt file. See Prisma Access IP Address Retrieval Using the API Examples for examples. The examples in this document use a file name of options.txt but you can specify any file name, as long as you reference it in the command.
Argument Possible choices (keywords) Comments serviceTypeallremote_networkgp_gatewaygp_portalclean_pipeswg_proxyall—Retrieves IP addresses you need to add to an allow list for all service types (Remote Networks, Mobile Users (both gateways and portals), and Clean Pipe, as applicable to your deployment).remote_network—Retrieves IP addresses you need to add to an allow list for remote network deployments.gp_gateway—Retrieves the Mobile Users—GlobalProtect gateway IP addresses you need to add to an allow list for mobile user deployments.gp_portal —Retrieves the Mobile Users—GlobalProtect portal IP addresses you need to add to an allow list for mobile user deployments.clean_pipe—Retrieves the IP addresses you need to add to an allow list for clean pipe deployments.swg_proxy—Retrieves the Mobile Users—Explicit Proxy IP addresses for the authentication cache service (ACS) and the network load balancers (relevant for explicit proxy deployments only).addrTypeallactiveservice_ipauth_cache_servicenetwork_load_balancerall or active—Retrieves all the IP addresses you need to add to an allow list.This API does not retrieve loopback IP addresses. To retrieve loopback IP addresses, use the legacy API.service_ip—Retrieves the Service IP Address, which you use as the peer IP address when you set up the IPSec tunnel for the remote network connection.auth_cache_service—Retrieves the IP address for the explicit proxy ACS (applicable to Explicit Proxy deployments only).network_load_balancer—Retrieves the IP address for the explicit proxy network load balancer (applicable to Explicit Proxy deployments only).actionTypepre_allocateMobile User deployments only—An actionType of pre_allocate allows you to retrieve IP addresses or subnets for Prisma Access gateways and portals for mobile user deployments. Use this with a serviceType of gp_gateway to retrieve pre-allocated gateway IP addresses and a serviceType of gp_portal to retrieve pre-allocated portal IP addresses.Retrieving the pre-allocated IP addresses lets you add the gateway and portal IP addresses to your organization’s allow lists before you onboard mobile user locations, which in turn gives mobile users access to external SaaS apps immediately after you onboard the locations. See Pre-Allocate IP Addresses for Prisma Access Mobile User Locations for details.locationalldeployedall—Retrieves the IP addresses from all locations. For mobile user deployments, this keyword retrieves the IP addresses for both locations you added during onboarding, and locations you did not add.deployed—Retrieves IP addresses in all locations that you added during mobile user onboarding.This keyword is applicable to mobile user deployments only. Prisma Access associates IP addresses for every mobile user location during provisioning, even if you didn’t select that location during mobile user onboarding. If you specify all, the API command retrieves the IP addresses for all mobile user locations, including ones you didn’t select for the deployment. If you specify deployed, the API command retrieves only the IP addresses for the locations you selected during onboarding.Specify the options in the .txt file in the following format:{ "serviceType": "service-type", "addrType": "address-type", "location": "location" }
- Enter one of the following commands to retrieve the IP addresses.
- To use the API that was introduced in Prisma Access 2.1, enter the following command:
curl -X POST --data @option.txt -H header-api-key:Current-API-Key "https://api.prod.datapath.prismaaccess.com/getPrismaAccessIP/v2"
- To use the legacy API, enter the following command. This command uses a legacy API endpoint that will be deprecated in May 2022:
curl -X POST --data @option.txt -k -H header-api-key:Current-API-Key "https://api.gpcloudservice.com/getPrismaAccessIP/v2"
Where option.txt is the .txt file you created in Step2and Current-API-Key is the Prisma Access API key.For example, given a .txt file name of option.txt and an API key of 12345abcde, use the following API command to retrieve the public IP address for all locations:curl -X POST --data @option.txt -H header-api-key:12345abcde "https://api.prod.datapath.prismaaccess.com/getPrismaAccessIP/v2"
The API command can return a large amount of information. To make the output more readable, if you have Python installed, you can add | python -m json.tool at the end of the CURL command.The API command returns the addresses in the following format:{ "result": [ { "address_details": [ { "address": "1.2.3.4" "allow_listed": false "addressType": "address-type" "serviceType": "service-type" } ], "addresses": [ "1.2.3.4" ] "zone": "zone-name", "zone_subnet": [zone-subnet ] }, "status": "success"
Where:- address_details shows the details of the address for each location.
- serviceType shows the type of IP address (either remote network (remote_network), Prisma Access gateway (gp_gateway), Prisma Access portal (gp_portal), or Clean Pipe (clean_pipe).
- addressType specifies the type of address specified with the addrType keyword (either all, active, or pre-allocated if you Pre-Allocate IP Addresses for Prisma Access Mobile User Locations).
- address shows the IP address you need to add to your allow lists.If the API returns multiple IP addresses, Prisma Access summarizes the IP addresses in the addresses field.
- addresses lists all the IP addresses for the location that you need to add to your allow lists.
- zone is the Prisma Access location associated with the IP addresses.
- zone_subnet is the subnet for mobile user gateways and portals. Prisma Access also provides this subnet if you Pre-Allocate IP Addresses for Prisma Access Mobile User Locations.
If there are any problems with the options in the .txt file, the API returns an error similar to the following:{"status": "error","result": "Invalid json format in the request. trace_id: xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx "}
- Update the allow lists on your on-premises servers or SaaS application policy rules with the IP addresses you retrieved.