Focus

IP Address Pools in a Mobile Users—GlobalProtect Deployment

Table of Contents

Filter

Expand All | Collapse All

Prisma Access Docs

Administration
Version
- Prisma Access China
- 4.0 & Later
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
Integrations
Incidents & Alerts
Release Notes
Version
- 5.0 Preferred and Innovation
- 4.2 Preferred
- 4.1 Preferred
- 4.0 Preferred
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred

Planning Checklist—GlobalProtect on Prisma Access

Set Up GlobalProtect on Panorama Managed Prisma Access

IP Address Pools in a Mobile Users—GlobalProtect Deployment

Make sure that you have specified an IP address pool that allows enough coverage for the mobile users in your organization. It is important to remember that each unique user can use multiple devices to connect to Prisma Access at the same time, and each connected device requires a unique IP address from the pool. The addresses in this pool must not overlap with other address pools you use internally or with the IP subnet you assign when you Enable the Service Infrastructure.

You can specify IP pools for all users in the world (Worldwide), per Prisma Access theater, or per location group.

We recommend that the number of IP addresses in the pool is 2 times the number of mobile user devices that will connect to Prisma Access. If your organization has a bring your own device (BYOD) policy, or if a single user has multiple user accounts, make sure that you take those extra devices and accounts into consideration when you allocate your IP pools. If your pool space is limited, you can specify a smaller address pool; however, if your IP address pool reaches its limit, additional mobile user devices will not be able to connect.

In Panorama, the UI validates that you enter valid IP subnets (for example, if you enter a pool with a subnet of less than /23, it will prompt you to change it). However, it does not check to ensure that you have allocated sufficient IP addresses for your deployment.

This validation is not available if you configure locations using CLI. If you deploy all locations using CLI, we recommend that you add a /18 address in the Worldwide pool for mobile users.

Prisma Access checks your configuration to make sure that you have specified the following minimum IP address pool:

A minimum of /23 (512 IP addresses) is required for either a Worldwide or regional address pool.

If you do not onboard any Prisma Access gateways in a region, an IP address pool for that region is not required. For example, if you specify gateways in the US Northwest, US West, and US Southwest locations, you need to only specify an IP address pool for the North America & South America region. Conversely, if you enable mobile user locations in Europe without specifying either a Worldwide address pool or the Africa, Europe, & Middle East theater, your deployment will fail.

GlobalProtect mobile users consume the IP addresses in the location group first, then theater-specific IP addresses, then Worldwide IP addresses. For example, if you specify a pool for a location group and Worldwide, and you then exhaust the available IP addresses in the location group pool, Prisma Access then takes IP addresses from the

Worldwide

pool to use in that location group.

If you specify more than one block of IP address pools, Prisma Access uses the pools in the order that you entered them during mobile user setup.

Planning Checklist—GlobalProtect on Prisma Access

Set Up GlobalProtect on Panorama Managed Prisma Access

Prisma Access Docs

IP Address Pools in a Mobile Users—GlobalProtect Deployment

Prisma Access Docs

IP Address Pools in a Mobile Users—GlobalProtect Deployment

Recommended For You

Activation & Onboarding

SASE

Cloud-Delivered Security Services

Network Security

Endpoints

Visibility & Monitoring

Best Practices

Experts Corner