Run the API Script Used to Retrieve IP Addresses

1. Get the API key.

   You need this key to authenticate to Prisma Access and retrieve the list of IP addresses using the API command. Only a Panorama administrator or Superuser can generate or access this API key.

   1. Select PanoramaCloud ServicesConfigurationService Setup.
   2. Select Generate API Key.

      If you have already generated an API key, the Current Key displays. If you haven’t yet generated a key or want to replace the existing key to meet audit or compliance check for key rotation, click Generate New API Key for a new key.
2. Create a .txt file and put the API command options in the file.

   Using the API the command to use is a two-step process. First, you create a .txt file, specifying the parameters for the IP addresses to retrieve, and save the file in a folder that is reachable from the location where you run the command. Then, you run the API and specify the name and location of the .txt file you created in the command.

   Specify the following keywords and arguments in the .txt file. See API Command Examples for examples. The examples in this document use a file name of options.txt but you can specify any file name, as long as you reference it in the command.

   Argument	Possible choices (keywords)	Comments
   serviceType	all remote_network gp_gateway gp_portal clean_pipe swg_proxy	all—Retrieves IP addresses you need to add to an allow list for all service types (Remote Networks, Mobile Users (both gateways and portals), and Clean Pipe, as applicable to your deployment). remote_network—Retrieves IP addresses you need to add to an allow list for remote network deployments. gp_gateway—Retrieves the Mobile Users—GlobalProtect gateway IP addresses you need to add to an allow list for mobile user deployments. gp_portal —Retrieves the Mobile Users—GlobalProtect portal IP addresses you need to add to an allow list for mobile user deployments. clean_pipe—Retrieves the IP addresses you need to add to an allow list for clean pipe deployments. swg_proxy—Retrieves the Mobile Users—Explicit Proxy IP addresses for the authentication cache service (ACS) and the network load balancers (relevant for explicit proxy deployments only).
   addrType	all active service_ip auth_cache_service network_load_balancer	all or active—Retrieves all the IP addresses you need to add to an allow list. This API does not retrieve loopback IP addresses. To retrieve loopback IP addresses, use the legacy API. service_ip—Retrieves the Service IP Address, which you use as the peer IP address when you set up the IPSec tunnel for the remote network connection. auth_cache_service—Retrieves the IP address for the explicit proxy ACS (applicable to Explicit Proxy deployments only). network_load_balancer—Retrieves the IP address for the explicit proxy network load balancer (applicable to Explicit Proxy deployments only).
   actionType	pre_allocate	Mobile User deployments only—An actionType of pre_allocate allows you to retrieve IP addresses or subnets for Prisma Access gateways and portals for mobile user deployments. Use this with a serviceType of gp_gateway to retrieve pre-allocated gateway IP addresses and a serviceType of gp_portal to retrieve pre-allocated portal IP addresses. Retrieving the pre-allocated IP addresses lets you add the gateway and portal IP addresses to your organization’s allow lists before you onboard mobile user locations, which in turn gives mobile users access to external SaaS apps immediately after you onboard the locations. See Pre-Allocate IP Addresses for Mobile User Locations for details.
   location	all deployed	all—Retrieves the IP addresses from all locations. For mobile user deployments, this keyword retrieves the IP addresses for both locations you added during onboarding, and locations you did not add. deployed—Retrieves IP addresses in all locations that you added during mobile user onboarding. This keyword is applicable to mobile user deployments only. Prisma Access associates IP addresses for every mobile user location during provisioning, even if you didn’t select that location during mobile user onboarding. If you specify all, the API command retrieves the IP addresses for all mobile user locations, including ones you didn’t select for the deployment. If you specify deployed, the API command retrieves only the IP addresses for the locations you selected during onboarding.

   Specify the options in the .txt file in the following format:

     {
      "serviceType": "service-type",   
      "addrType": "address-type",
      "location": "location"
      }

3. Enter one of the following commands to retrieve the IP addresses.

   • To use the API that was introduced in Prisma Access 2.1, enter the following command:

       curl -X POST --data @option.txt -H header-api-key:Current-API-Key "https://api.prod.datapath.prismaaccess.com/getPrismaAccessIP/v2"

   • To use the legacy API, enter the following command. This command uses a legacy API endpoint that will be deprecated in May 2022:

       curl -X POST --data @option.txt -k -H header-api-key:Current-API-Key "https://api.gpcloudservice.com/getPrismaAccessIP/v2"

   Where option.txt is the .txt file you created in Step 2 and Current-API-Key is the Prisma Access API key.

   For example, given a .txt file name of option.txt and an API key of 12345abcde, use the following API command to retrieve the public IP address for all locations:

     curl -X POST --data @option.txt -H header-api-key:12345abcde "https://api.prod.datapath.prismaaccess.com/getPrismaAccessIP/v2"

   The API command can return a large amount of information. To make the output more readable, if you have Python installed, you can add | python -m json.tool at the end of the CURL command.

   The API command returns the addresses in the following format:

    {
      "result": [        
       {            
        "address_details": [
         {
           "address": "1.2.3.4"    
           "allow_listed": false
           "addressType": "address-type"
           "serviceType": "service-type"
            }
          ],
           "addresses": [
             "1.2.3.4"
           ]
           "zone": "zone-name",
         "zone_subnet": [zone-subnet
   ]
   },
     "status": "success"

   Where:

   • address_details shows the details of the address for each location.
     • serviceType shows the type of IP address (either remote network (remote_network), Prisma Access gateway (gp_gateway), Prisma Access portal (gp_portal), or Clean Pipe (clean_pipe).
     • addressType specifies the type of address specified with the addrType keyword (either all, active, , or pre-allocated if you are Pre-Allocate IP Addresses for Mobile User Locations).
     • address shows the IP address you need to add to your allow lists.
       If the API returns multiple IP addresses, Prisma Access summarizes the IP addresses in the addresses field.
   • addresses lists all the IP addresses for the location that you need to add to your allow lists.
   • zone is the Prisma Access location associated with the IP addresses.
   • zone_subnet is the subnet for mobile user gateways and portals. Prisma Access also provides this subnet if you Pre-Allocate IP Addresses for Mobile User Locations.

   If there are any problems with the options in the .txt file, the API returns an error similar to the following:

     {"status": "error","result": "Invalid json format in the request. trace_id: xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx "}

4. Update the allow lists on your on-premises servers or SaaS application policy rules with the IP addresses you retrieved.

API Command Examples

  {
"serviceType": "gp_gateway",
"addrType": "all",
"location": "all"
   }

  {
"serviceType": "gp_gateway",
"addrType": "all",
"location": "deployed"
   }

  {
"serviceType": "gp_gateway",
"addrType": "active",
"location": "deployed"
   }

  {
"serviceType": "remote_network",
"addrType": "all",
"location": "all"
   }

  {
"serviceType": "clean_pipe",
"addrType": "all",
"location": "all"
   }

{
"serviceType": "swg_proxy",
"location": "deployed",
"addrType": "auth_cache_service"
}

Pre-Allocate IP Addresses for Mobile User Locations

1. Retrieve the Prisma Access API key.
2. Pre-allocate the mobile user egress IP addresses by creating a .txt file and specifying the following options in the .txt file you create.

   Enter the following text in the .txt file:

   • Mobile Users—GlobalProtect Deployments:

       {
        "actionType": "pre_allocate",   
        "serviceType": "gp_gateway",
        "location": ["location"]
        }

   • Mobile Users—Explicit Proxy Deployments:

     {
     "actionType": "pre_allocate",
     "serviceType": "swg_proxy",
     "location": ["location"]}

   Where location is the Prisma Access location or locations where you want to pre-allocate the IP addresses. If you enter multiple locations, use brackets around the set of locations and separate each location entry with quotes, a comma, and a space (for example, ["location1", "location2", "location3"], and so on).

   Enter a maximum of 12 locations. Entering more than 12 locations might cause timeout errors when Prisma Access retrieves the pre-allocated IP addresses.
3. Enter the CURL command as shown in Step 3 in Run the API Script Used to Retrieve IP Addresses.
4. Retrieve the IP addresses and subnets you requested, including their validity period, by re-opening the .txt file, removing the existing information, and editing it.

   • Mobile Users—GlobalProtect Deployments:
     • To request Prisma Access to retrieve all pre-allocated IP addresses, enter the following text in the .txt file.

         {
          "serviceType": "all",   
          "addrType": "pre_allocated",
          "location": "all"
          }

     • To request Prisma Access to retrieve all pre-allocated IP addresses for Prisma Access gateways for a given location, enter the same information in the .txt file but substitute all with gp_gateway in the .txt file.
     • To request Prisma Access to retrieve all pre-allocated IP addresses for Prisma Access portals for a given location, enter the same information in the .txt file but substitute all with gp_portal in the .txt file.
   • Mobile Users—Explicit Proxy Deployments:
     To request that Prisma Access pre-allocate all IP addresses you need to add to allow lists for an explicit proxy deployment, enter the following text in the .txt file.

     {
     "actionType": "pre_allocate",
     "serviceType": "swg_proxy",
     "location": ["all"]
     }

   Palo Alto Networks recommends that you enter all so you can retrieve all required pre-allocated egress IP addresses to add to your allow lists.

   For Mobile Users—GlobalProtect deployments, while Prisma Access returns up to four addresses for each location (two gateway IP addresses and, if required, two portal IP addresses), the API command can return a large amount of information. To make the output more readable, if you have Python installed, you can add | python -m json.tool at the end of the CURL command.
5. Re-enter the CURL command as shown in Step 3 in Run the API Script Used to Retrieve IP Addresses to retrieve the pre-allocated addresses.

   Prisma Access returns the information in the following format:

       "result": [
          {
               "zone": "prisma-access-zone1",
               "addresses": [
     ["ip-address1","ip-address2"]
               "zone_subnet" :  
     [subnet-and-mask1","subnet-and-mask2"]
               "address_details":[
                             {"address":"ip-address1",
                              "service_type":"service-type",                         
                               "addressType":"pre-allocated",
                              "expiring_in" : "validity-period" },
                             {"address":"ip-address2",
                              "service_type":"gp_gateway",
                              "addressType":"pre-allocated",
                              "validity_period_remaining" : "90 days" } ,        
            },        

   Where the variables represent the following API command output:

   Variable	Explanation
   prisma-access-zone1	The Prisma Access location for which pre-allocated IP addresses were retrieved.
   ip-address1 and ip-address2	The egress IP addresses that Prisma Access has pre-allocated for the specified location. Prisma Access retrieves two IP addresses for each location; you must add both of these IP addresses to your allow lists.
   subnet-and-mask1 and subnet-and-mask2	The subnets that Prisma Access has pre-allocated and reserved for the egress IP addresses in your deployment.
   service-type	The type of the pre-allocated egress IP address (either gp_portal for a Prisma Access portal or gp_gateway for a Prisma Access gateway).
   validity-period	The remaining time, in days, for which the pre-allocated IP address is valid. You must onboard your mobile user location before the IP addresses’ validity period ends. If the pre-allocated IP addresses expire, you can rerun the API script to retrieve another set of pre-allocated IP addresses.

   You could receive an error if you attempt to pre-allocate IP addresses for locations that meet one of the following criteria:

   • You have already onboarded the location.
   • You onboarded, then deleted the location.
     In this case, enter the following text in the .txt file to retrieve the Mobile Users—GlobalProtect IP addresses for the location:

       {
     "serviceType": "gp_gateway",
     "addrType": "all",
     "location": "all"
        }

   • You have reached the maximum number of mobile user locations allowed by your license and cannot add any more locations.
   • You entered the location name incorrectly.
   • You entered a serviceType other than gp_gateway.
   • you entered an actionType other than pre_allocate.

Be Notified of Changes to IP Addresses

  {"addrType": "public_ip", "addrChangeType": "add", "utc_timestamp": "2019-01-31 23:08:19.383894", "text": "Address List Change Notification"}

  {"addrType": "public_ip", "addrChangeType": "delete", "utc_timestamp": "2019-01-31 23:13:35.882151", "text": "Address List Change Notification"}

  {"addrType": "loopback_ip", "addrChangeType": "update", "utc_timestamp": "2019-01-31 23:29:27.100329", "text": "2018-05-11 23:29:27.100329"}

1. Select PanoramaCloud ServicesConfigurationService Setup.
2. Add an IP Change Event Notification URL where you can be notified of IP address changes in your Prisma Access infrastructure.

   You can specify an IP address or an FQDN to an HTTP or HTTPS web service that is listening for change notifications. Prisma Access sends these notifications from the internet using a public IP address.

   You do not need to commit your changes for the notification URL to take effect.

Legacy Scripts Used to Retrieve IP and Loopback Addresses