Retrieve the IP Addresses for Prisma Access
Find the Prisma Access IP addresses that you need to
add to your organization’s allow lists.
If you are manually adding IP addresses of
your Prisma Access infrastructure to an allow list in your network,
or if you are using an automation script to enforce IP-based restrictions
to limit inbound access to enterprise applications, you should understand
what these addresses do and why you need to allow them, as well
as the tasks you perform to retrieve them.
While you do not
perform these tasks until after you complete your Prisma Access
configuration, it is useful to understand these concepts in advance,
so you understand what to do after your deployment is complete.
To learn about events that cause Prisma Access
IP addresses to change and to plan for those changes, see Plan for IP Address Changes for Mobile Users, Remote Networks, and Service Connections.
Prisma Access Infrastructure IP Addresses
The following table provides you with a list
of the IP address that Prisma Access uses for each deployment type,
along with the keyword you use when you run the API script to
retrieve the IP addresses, and whether or not you need to add them
to an allow list.
For mobile users, during initial deployment,
Prisma Access assigns two sets of IP addresses for each location
you deploy: one set that is assigned to Prisma Access locations
and portals that are currently active, and another set to reserve
in case of a scaling event, infrastructure upgrade, or other event that
causes Prisma Access to add locations, portals, or both. The API
script allows you to retrieve the reserved set of IP addresses before
they are used, preventing any issues with mobile users being able
to access SaaS or public applications during a scaling event.
Deployment Type | IP Address Type | Description |
---|---|---|
Mobile User | Prisma Access gateway ( gp_gateway ) | Retrieves the gateway IP addresses. You
must add both gateway and portal IP addresses to allow lists for
your mobile user deployments. Mobile users connect to a Prisma Access
gateway to access internal or internet resources, such as SaaS or
public applications, for which you have provided access. |
Prisma Access portal ( gp_portal ) | Retrieves the portal IP addresses. You must
add both gateway and portal IP addresses to allow lists for your
mobile user deployments. As with gateways, you can retrieve both
the active IP addresses and ones that are reserved for a scaling
event. See Run the API Script Used to Retrieve IP Addresses for examples. Mobile
users log in to the Prisma Access portal to receive their initial configuration
and gateway location. | |
Loopback IP addresses | This address is the source IP address used
by Prisma Access for requests made to an internal source, and is
assigned from the infrastructure subnet. Add
the loopback IP address to an allow list in your network to give
Prisma Access access to internal resources such as RADIUS or Active
Directory authentication servers. Palo Alto Networks recommends
that you allow all the IP addresses of the entire infrastructure
subnet in your network, because loopback addresses
for mobile users can change. To find the infrastructure subnet,
select Panorama Cloud Services Status Network Details Service Infrastructure Infrastructure Subnet area.To
retrieve loopback IP addresses, use the legacy API
command. | |
Remote Network | Remote Network IP addresses ( remote_network ) | Includes Service IP Addresses that
Prisma Access assigns for the Prisma Access remote network connection,
and egress IP addresses that
Prisma Access uses to make sure that remote network users get the
correct default language for their region. Add these addresses to
allow lists in your network to give Prisma Access access to internet
resources. |
Loopback IP addresses | This is the source IP address used by Prisma
Access for requests made to an internal source, and is assigned
from the infrastructure subnet.
Add the loopback IP address to an allow list to give Prisma Access
access to internal resources such as RADIUS or Active Directory
authentication servers. To retrieve loopback IP addresses, use the legacy API command. | |
Clean Pipe | Clean Pipe IP Addresses ( clean_pipe ) | If you have a Clean Pipe deployment, add these
IP addresses to an allow list to give the Clean Pipe service access
to internet resources. |
Loopback IP addresses | This is the source IP address used by Prisma
Access for requests made to an internal source, and is assigned
from the infrastructure subnet.
Add the loopback IP address to an allow list to give Prisma Access
access to internal resources such as RADIUS or Active Directory
authentication servers. To retrieve loopback IP addresses, use the legacy API command. |
Run the API Script Used to Retrieve IP Addresses
Use the following steps to retrieve the IP
addresses that Prisma Access uses in its infrastructure.
This
command does not retrieve loopback addresses; to retrieve loopback
IP addresses, use the legacy API
command.
- Get the API key.You need this key to authenticate to Prisma Access and retrieve the list of IP addresses using the API command. Only a Panorama administrator or Superuser can generate or access this API key.
- Select.PanoramaCloud ServicesConfigurationService Setup
- SelectGenerate API Key.If you have already generated an API key, theCurrent Keydisplays. If you haven’t yet generated a key or want to replace the existing key to meet audit or compliance check for key rotation, clickGenerate New API Keyfor a new key.
- Create a .txt file and put the API command options in the file.Using the API the command to use is a two-step process. First, you create a .txt file, specifying the parameters for the IP addresses to retrieve, and save the file in a folder that is reachable from the location where you run the command. Then, you run the API and specify the name and location of the .txt file you created in the command.Specify the following keywords and arguments in the .txt file. See API Command Examples for examples. The examples in this document use a file name ofoptions.txtbut you can specify any file name, as long as you reference it in the command.ArgumentPossible choices (keywords)CommentsserviceTypeallremote_networkgp_gatewaygp_portalclean_pipeall—Retrieves IP addresses you need to add to an allow list for all service types (Remote Networks, Mobile Users (both gateways and portals), and Clean Pipe, as applicable to your deployment).remote_network—Retrieves IP addresses you need to add to an allow list for remote network deployments.gp_gateway—Retrieves the gateway IP addresses you need to add to an allow list for mobile user deployments.gp_portal—Retrieves the portal IP addresses you need to add to an allow list for mobile user deployments.clean_pipe—Retrieves the IP addresses you need to add to an allow list for clean pipe deployments.addrTypeallactivereservedall—Retrieves all the IP addresses you need to add to an allow list.active—Retrieves the active IP addresses. This keyword is applicable to mobile user deployments only.reserved—Retrieves the reserved IP addresses. This keyword is applicable to mobile user deployments only.This API does not retrieve loopback IP addresses. To retrieve loopback IP addresses, use the legacy API command.actionTypepre_allocateMobile User deployments only—AnactionTypeofpre_allocateallows you to retrieve IP addresses or subnets for Prisma Access gateways and portals for mobile user deployments. Use this with aserviceTypeofgp_gatewayto retrieve pre-allocated gateway IP addresses and aserviceTypeofgp_portalto retrieve pre-allocated gateway IP addresses.Retrieving the pre-allocated IP addresses lets you add the gateway and portal IP addresses to your organization’s allow lists before you onboard mobile user locations, which in turn gives mobile users access to external SaaS apps immediately after you onboard the locations. See Pre-Allocate IP Addresses for Mobile User Locations for details.locationalldeployedall—Retrieves the IP addresses from all locations. For mobile user deployments, this keyword retrieves the IP addresses for both locations you added during onboarding, and locations you did not add.deployed—Retrieves IP addresses in all locations that you added during mobile user onboarding.This keyword is applicable to mobile user deployments only. Prisma Access associates IP addresses for every mobile user location during provisioning, even if you didn’t select that location during mobile user onboarding. If you specifyall, the API command retrieves the IP addresses for all mobile user locations, including ones you didn’t select for the deployment. If you specifydeployed, the API command retrieves only the IP addresses for the locations you selected during onboarding.Specify the options in the .txt file in the following format:{ "serviceType": "service-type", "addrType": "address-type", "location": "location" }
- Enter the following command to retrieve the IP addresses:curl -X POST --data @option.txt-k -H header-api-key:Current-API-Key"https://api.gpcloudservice.com/getPrismaAccessIP/v2"Whereoption.txtis the .txt file you created in Step 2 andCurrent-API-Keyis the Prisma Access API key.For example, given a .txt file name ofoption.txtand an API key of12345abcde, use the following API command to retrieve the public IP address for all locations:curl -X POST --data @option.txt -k -H header-api-key:12345abcde "https://api.gpcloudservice.com/getPrismaAccessIP/v2"The API command can return a large amount of information. To make the output more readable, if you have Python installed, you can add| python -m json.toolat the end of the CURL command.The API command returns the addresses in the following format:{ "result": [ { "address_details": [ { "address": "1.2.3.4" "addressType": "address-type" "serviceType": "service-type" } ], "addresses": [ "1.2.3.4" ] "zone": "zone-name", "zone_subnet": [zone-subnet] }, "status": "success"Where:
- address_detailsshows the details of the address for each location.
- serviceTypeshows the type of IP address (either remote network (remote_network), Prisma Access gateway (gp_gateway), Prisma Access portal (gp_portal), or Clean Pipe (clean_pipe).
- addressTypespecifies the type of address specified with theaddrTypekeyword (eitheractive,reserved, orpre-allocatedif you are pre-allocating IP addresses for mobile user locations).
- addressshows the IP address you need to add to your allow lists.If the API returns multiple IP addresses (for example, if you have IP addresses for an active and a reserved Prisma Access gateway), Prisma Access summarizes the IP addresses in theaddressesfield.
- addresseslists all the IP addresses for the location that you need to add to your allow lists.
- zoneis the Prisma Access location associated with the IP addresses.
- zone_subnetis the subnet for mobile user gateways and portals. Prisma Access also provides this subnet if you pre-allocate mobile user IP addresses.
If there are any problems with the options in the .txt file, the API returns an error similar to the following:{"status": "error","result": "Invalid json format in the request. trace_id: xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx "} - Update the allow lists on your on-premises servers or SaaS application policy rules with the IP addresses you retrieved.
API Command Examples
Use the following examples when entering keywords
and arguments in the .txt file for the API command. To change the
output of the command, change the options in the .txt file; the
command itself does not change.
Retrieve These IP Addresses | Specify These Parameters in the .txt File | Comments |
---|---|---|
Mobile User IP Addresses | ||
All active and reserved mobile user IP Addresses |
| An addrType of all means
that Prisma Access retrieves both active and reserved IP addresses
for the locations you selected during mobile user
onboarding.A location of all means that
Prisma Access retrieves IP addresses for all available locations,
including ones that you have not onboarded. Prisma Access reserves
non-onboarded location IP addresses so that you can add these IP
addresses to your allow lists before you onboard them. |
Active and reserved IP addresses for onboarded
mobile user locations |
| A location type of deployed means
that Prisma Access retrieves only the IP addresses for the locations
that you selected during mobile user
onboarding. |
All active IP Addresses for onboarded mobile user
locations |
| An addrType of active means
that Prisma Access retrieves only the active IP addresses, and does
not retrieve reserved IP addresses, for the locations you onboarded. |
All reserved IP Addresses for onboarded
mobile user locations |
| An addrType of reserved means
that Prisma Access retrieves only the reserved IP addresses for the
locations you onboarded. Do not use an addrType of reserved with
a location of all ; Prisma
Access does not allocate active and reserved IP addresses to locations
that you have not onboarded. |
Remote Network IP Addresses | ||
Retrieve all remote network IP addresses |
| This command retrieves the public and egress
IP addresses of remote networks you have onboarded. Do not use a location of deployed or
an addrType of reserved . You
can use an addrType of active but
it retrieves the same addresses as if you specified an addrType of all . |
Clean Pipe IP Addresses | ||
Retrieve all clean pipe IP addresses |
| This command retrieves the public and egress
IP addresses of clean pipes you have onboarded. Do not use a location of deployed or
an addrType of reserved . You
can use an addrType of active but
it retrieves the same addresses as if you specified an addrType of all . |
Pre-Allocate IP Addresses for Mobile User Locations
Prisma Access uses gateway and portal IP addresses
in mobile user deployments. These IP addresses are known collectively
as
egress IP addresses
. If you require these
egress IP addresses before you onboard the location (for example,
if your organization needs to add the egress IP addresses to allow
lists to give mobile users access to external SaaS applications),
you can run an API script to
have Prisma Access pre-allocate these IP addresses for a location
ahead of time, before you onboard it. You can then add the location’s
egress IP addresses to your organization’s allow lists before onboarding
the location.The API response also includes the public IP
pool subnets for the egress IP addresses for the requested location.
The egress IP addresses of any locations you add are a part of this
subnet. Adding the subnets to your allow lists provides for future
location additions without further allow list modification.
Prisma
Access does not pre-allocate your IP addresses and subnets unless
you request them using the API script. After you run the pre-allocation
script, they have a validity period of 90 days. The IP addresses
that Palo Alto Networks provides you are unique, not shared, and
dedicated to your Prisma Access deployment during the validity period.
You must onboard your locations before the validity period ends
or you lose the addresses; to find the validity period at any time,
run the API script.
Palo Alto Networks recommends that
you only pre-allocate IP addresses for locations that you want to
onboard later.
To pre-allocate IP addresses, complete
the following task.
- Retrieve the Prisma Access API key.
- Pre-allocate the mobile user egress IP addresses by creating a .txt file and specifying the following options in the .txt file you create.Enter the following text in the .txt file:{ "actionType": "pre_allocated", "serviceType": "gp_gateway", "location": "location" }Wherelocationis the Prisma Access location where you want to pre-allocate the IP addresses.Enter a maximum of 12 locations. Entering more than 12 locations might cause timeout errors when Prisma Access retrieves the pre-allocated IP addresses.
- Enter the CURL command as shown in Step 3 in Run the API Script Used to Retrieve IP Addresses.
- Retrieve the IP addresses and subnets you requested, including their validity period, by re-opening the .txt file, removing the existing information, and editing it.
- To request Prisma Access to retrieve all pre-allocated IP addresses, enter the following text in the .txt file.{ "serviceType": "all", "addrType": "pre_allocated", "location": "all" }
- To request Prisma Access to retrieve all pre-allocated IP addresses for Prisma Access gateways for a given location, enter the same information in the .txt file but substituteallwithgp_gatewayin the .txt file.
- To request Prisma Access to retrieve all pre-allocated IP addresses for Prisma Access portals for a given location, enter the same information in the .txt file but substituteallwithgp_portalin the .txt file.
Palo Alto Networks recommends that you enterallso you can retrieve all required pre-allocated egress IP addresses to add to your allow lists.While Prisma Access returns up to four addresses for each location (one active and one reserved gateway IP address and, if required, one active and one reserved portal IP address), the API command can return a large amount of information. To make the output more readable, if you have Python installed, you can add| python -m json.toolat the end of the CURL command. - Re-enter the CURL command as shown in Step 3 in Run the API Script Used to Retrieve IP Addresses to retrieve the pre-allocated addresses.Prisma Access returns the information in the following format:"result": [ { "zone": "prisma-access-zone1", "addresses": [ ["ip-address1","ip-address2"] "zone_subnet" : [subnet-and-mask1","subnet-and-mask2"] "address_details":[ {"address":"ip-address1", "service_type":"service-type", "addressType":"pre-allocated", "expiring_in" : "validity-period" }, {"address":"ip-address2", "service_type":"gp_gateway", "addressType":"pre-allocated", "validity_period_remaining" : "90 days" } , },Where the variables represent the following API command output:VariableExplanationprisma-access-zone1The Prisma Access location for which pre-allocated IP addresses were retrieved.ip-address1andip-address2The egress IP addresses that Prisma Access has pre-allocated for the specified location.Prisma Access retrieves two IP addresses for each location; you must add both of these IP addresses to your allow lists.subnet-and-mask1andsubnet-and-mask2The subnets that Prisma Access has pre-allocated and reserved for the egress IP addresses in your deployment.service-typeThe type of the pre-allocated egress IP address (eithergp_portalfor a Prisma Access portal orgp_gatewayfor a Prisma Access gateway).validity-periodThe remaining time, in days, for which the pre-allocated IP address is valid.You must onboard your mobile user location before the IP addresses’ validity period ends. If the pre-allocated IP addresses expire, you can rerun the API script to retrieve another set of pre-allocated IP addresses.You could receive an error if you attempt to pre-allocate IP addresses for locations that meet one of the following criteria:
- You have already onboarded the location.
- You onboarded, then deleted the location.In this case, enter the following text in the .txt file to retrieve the IP addresses for the location:{ "serviceType": "gp_gateway", "addrType": "all", "location": "all" }
- You have reached the maximum number of mobile user locations allowed by your license and cannot add any more locations.
- You entered the location name incorrectly.
- You entered aserviceTypeother thangp_gateway.
- you entered anactionTypeother thanpre_allocated.
Be Notified of Changes to IP Addresses
To be notified of public IP address changes
for remote networks and loopback IP address changes for service
connections, remote network connections, and mobile users, you can
to specify a URL at which you can be alerted of a change. Prisma
Access uses an HTTP POST request to send the notification. This
POST request includes the following notification data in JSON format:
{"addrType": "public_ip", "addrChangeType": "add", "utc_timestamp": "2019-01-31 23:08:19.383894", "text": "Address List Change Notification"}
{"addrType": "public_ip", "addrChangeType": "delete", "utc_timestamp": "2019-01-31 23:13:35.882151", "text": "Address List Change Notification"}
{"addrType": "loopback_ip", "addrChangeType": "update", "utc_timestamp": "2019-01-31 23:29:27.100329", "text": "2018-05-11 23:29:27.100329"}
When
you receive a notification, you must follow a two-step process.
First, you must manually or programatically retrieve the IP or loopback addresses. Then,
you must update the IP addresses in your organization’s appropriate
allow list to ensure that users do not experience any disruption in
service.
Prisma Access sends this notification
a few seconds before the new IP address becomes active. We recommend
that you use automation scripts to both retrieve and add the new
IP addresses to an allow list in your network.
To add an
IP notification URL, complete the following task.
- Select.PanoramaCloud ServicesConfigurationService Setup
- Add anIP Change Event Notification URLwhere you can be notified of IP address changes in your Prisma Access infrastructure.You can specify an IP address or an FQDN to an HTTP or HTTPS web service that is listening for change notifications. Prisma Access sends these notifications from the internet using a public IP address.You do not need to commit your changes for the notification URL to take effect.
Legacy Scripts Used to Retrieve IP and Loopback Addresses
The commands described in this section
are superseded as of Prisma Access 1.5; however, they are still
supported for when you need to obtain the loopback address, or for
deployments that use them in scripts or other automated tools.
The
following table shows the keywords and parameters that are available
in the legacy API scripts used with Prisma Access, and provides
information and recommendations about which API to use for the type
of deployment you have.
These legacy commands retrieve two
types of IP addresses,
public IP
and egress IP
addresses.
We provide you with two different legacy API commands so that you
can retrieve all the IP addresses you need to add to an allow list.- Apublic IP addressis the source IP address that Prisma Access uses for requests made to an internet-based source. Add the public IP address to an allow list in your network to give Prisma Access access to internet resources such as SaaS applications or publicly accessible partner applications.Mobile user, remote network, and clean pipe deployments use public IP addresses.
- Anegress IP addressis an IP address that Prisma Access uses for egress traffic to the internet, and you must also add these addresses to an allow list to give Prisma Access access to internet resources.Among other purposes, Prisma Access uses egress IP addresses so that users receive web pages in the language they expect from a Prisma Access location. All locations have public IP addresses; however, not all locations have egress IP addresses. The following locations do not use egress IP addresses:
- Any locations that you added before the release of Prisma Access 1.4.
- Bahrain
- Belgium
- France North
- France South
- Hong Kong
- Ireland
- South Korea
- Taiwan
- United Kingdom
Mobile user, remote network, and clean pipe deployments use egress IP addresses.
Commands Used in Mobile User
Deployments | |
---|---|
Command Name | Comments |
get_egress_ip_all=yes commandcurl
-k -H header-api-key: Current-API-Key "https://api.gpcloudservice.com/getAddrList/latest?get_egress_ip_all=yes | This command retrieves all the IP addresses
that you add to an allow list to give Prisma Access access to internet resources
such as SaaS applications or publicly accessible partner applications.
This command has the following constraints:
|
gpcs_gp_gw and gpcs_gp_portal keywordscurl
-k -H header-api-key: Current-API-Key "https://api.gpcloudservice.com/getAddrList/latest?fwType= gpcs_gp_gw | gpcs_gp_portal &addrType= public_ip | egress_ip_list | loopback_ip " | Use this command if your deployment limits
the amount of IP addresses you can add to an allow list. You must
add all IP addresses returned with this command to an allow list
in your network. You can also retrieve the loopback IP addresses
with this command. This command has the following limitations:
|
Commands Used In Remote Network
Deployments | |
---|---|
Command Name | Comments |
gpcs_remote_network keywordcurl
-k -H header-api-key: Current-API-Key "https://api.gpcloudservice.com/getAddrList/latest?fwType= gpcs_remote_network &addrType= public_ip | egress_ip_list | loopback_ip " | Use this command to find the IP addresses
that you need to add to an allow list for remote network deployments. You
can also use this command to find the egress IP addresses for remote
network deployments; the egress and IP addresses can be different in some situations. |
Commands Used in Clean Pipe
Deployments | |
---|---|
Command Name | Comments |
gpcs_clean_pipe keywordcurl
-k -H header-api-key: Current-API-Key "https://api.gpcloudservice.com/getAddrList/latest?fwType= gpcs_clean_pipe &addrType= public_ip | egress_ip_list | loopback_ip " | Use this command to find the IP addresses
that you need to add to an allow list for clean pipe deployments. |
Retrieve Public and Egress IP Addresses for Mobile User Deployments
If you are adding public IP addresses to allow
lists to give mobile users access to SaaS or public applications,
Prisma Access provides two sets of public IP and egress IP addresses
so that it can automatically add locations during a scaling or other
event (for example, when a large number of mobile users join a single
gateway):
- One set that is assigned to Prisma Access locations and portals that are currently active.
- Another set to reserve in case of a scaling event, infrastructure upgrade, or other event that causes Prisma Access to add locations, portals, or both.
You can then add this reserved
set of IP addresses to an allow list before they are used, preventing
any issues with mobile users being able to access SaaS or public
applications during a scaling event. See IP Address Allocation For Mobile Users for more
information about the IP allocation process.
Retrieve these
new addresses by completing the following task:
- Get the API key by selecting; then, selectingPanoramaCloud ServicesConfigurationService SetupGenerate API Key.You need this key to authenticate to Prisma Access and retrieve the list of IP addresses using the curl command listed below. Only a Panorama administrator or Superuser can generate or access this API key.
- Enter the following command to retrieve the mobile user public IP addresses:curl -k -H header-api-key:Current-API-Key"https://api.gpcloudservice.com/getAddrList/latest?get_egress_ip_all=yes"WhereCurrent-API-Keyis the Prisma Access API key.For example, given an API key of12345abcde, use the following API command to retrieve the public IP address for all locations:curl -k -H header-api-key:12345abcde "https://api.gpcloudservice.com/getAddrList/latest?get_egress_ip_all=yes"Every time Prisma Access uses the reserved set of public IP addresses, it allocates another set of reserved IP addresses. If you think that Prisma Access has used the reserved set of public IP addresses (for example, if a large number of mobile users have accessed a single location), you can run this API command again to find the new set of reserved public IP addresses. All IP addresses persist after an upgrade.
Retrieve Public, Loopback, and Egress IP Addresses
To retrieve public, loopback, and egress IP
addresses, complete the following steps.
- Get the API key and add anIP Change Event Notification URLwhere you can be notified of IP address changes in your Prisma Access infrastructure.See Be Notified of Changes to IP Addresses for details.
- Retrieve the public IP addresses, loopback IP addresses, or both for Prisma Access.Use the API key and the API endpoint URL either manually or in an automation script:header-api-key:Current API Key"https://api.gpcloudservice.com/getAddrList/latest?fwType=$fwType&addrType=$addrType"where you need to replace Current API Key with your API key and use one or both of the following keywords and arguments:KeywordDescriptionfwTypekeywordgpcs_gp_gwRetrieves Prisma Access gateway IP addresses (for mobile user deployments).gpcs_gp_portalRetrieves Prisma Access portal IP addresses (for mobile user deployments).gpcs_remote_networkRetrieves Prisma Access remote network IP addresses (for remote network deployments).gpcs_clean_pipeRetrieves Prisma Access Clean Pipe IP addresses.addrTypekeywordpublic_ipRetrieves the source IP addresses that Prisma Access uses for requests made to an internet-based source.For mobile user locations, Prisma Access lists the IP addresses by location. For remote networks, Prisma Access lists the IP addresses by remote network name.egress_ip_listRetrieves the IP addresses that Prisma Access uses with public IP addresses for additional egress traffic to the internet.For mobile user locations, Prisma Access lists the IP addresses by location. For remote networks, Prisma Access lists the IP addresses by remote network name.loopback_ipRetrieves the source IP addresses used by Prisma Access for requests made to an internal source (for example, a RADIUS or Active Directory server), and is assigned from the infrastructure subnet.For example, you can try the following Curl command to manually retrieve the list of public IP addresses for all remote networks:If you don’t specify a keyword, Prisma Access retrieves all IP addresses.curl -k -H header-api-key:1234y9ydxb__0UmxetVTbC8XTyFMaoT4RBZBKBjfX419YVufeFG7 "https://api.gpcloudservice.com/getAddrList/latest?fwType=gpcs_remote_network&addrType=public_ip"or use a simple python script to retrieve the list of all IP addresses, for example:#!/usr/bin/python import subprocess import json api_key = '1234y9ydxb__0UmxetVTbC8XTyFMaoT4RBZBKBjfX419YVufeFG7' # Replace with your key api_end_point = 'https://api.gpcloudservice.com/getAddrList/latest' # This call retrieves IP addresses for all your Prisma Access firewalls args = ['curl', '-k', '-H', 'header-api-key:' + api_key, api_end_point] p = subprocess.Popen(args, stdout=subprocess.PIPE) output = p.communicate() dout = json.loads(output[0]) addrStrList = dout['result']['addrList'] addrList = [] for addr_str in addrStrList: addrList.append(addr_str.split(":")[1]) print(addrList)
- Update the allow lists on your on-premises servers or SaaS application policy rules with the IP addresses you retrieved.
Recommended For You
Recommended Videos
Recommended videos not found.