1. Home
    2. Prisma
    3. Prisma Access
    4. Prisma Access Administrator’s Guide (Panorama Managed)
    5. Prisma Access Overview
    6. Retrieve the IP Addresses for Prisma Access

    Retrieve the IP Addresses for Prisma Access

    If you are manually adding IP addresses of your Prisma Access infrastructure to an allow list in your network, or if you are using an automation script to enforce IP-based restrictions to limit inbound access to enterprise applications, you should understand what these addresses do and why you need to allow them, as well as the tasks you perform to retrieve them.
    While you do not perform these tasks until after you complete your Prisma Access configuration, it is useful to understand these concepts in advance, so you understand what to do after your deployment is complete.
    To learn about events that cause Prisma Access IP addresses to change and to plan for those changes, see Plan for IP Address Changes for Mobile Users, Remote Networks, and Service Connections.

    Prisma Access Infrastructure IP Addresses

    The following table provides you with a list of the IP address that Prisma Access uses for each deployment type, along with the keyword you use when you run the API script to retrieve the IP addresses, and whether or not you need to add them to an allow list.
    For mobile users, during initial deployment, Prisma Access assigns two sets of IP addresses for each location you deploy: one set that is assigned to Prisma Access locations and portals that are currently active, and another set to reserve in case of a scaling event, infrastructure upgrade, or other event that causes Prisma Access to add locations, portals, or both. The API script allows you to retrieve the reserved set of IP addresses before they are used, preventing any issues with mobile users being able to access SaaS or public applications during a scaling event.
    Deployment Type
    IP Address Type
    Description
    Mobile User
    GlobalProtect gateway (
    gp_gateway
    )
    Retrieves the gateway IP addresses you need to add to an allow list in your network for mobile user deployments.
    Mobile users connect to a Prisma Access gateway to access internal or internet resources, such as SaaS or public applications, for which you have provided access.
    GlobalProtect portal (
    gp_portal
    )
    Retrieves the portal IP addresses you need to add to an allow list for mobile user deployments. As with gateways, you can retrieve both the active IP addresses and ones that are reserved for a scaling event. See API Script Used to Retrieve IP Addresses for examples.
    Mobile users log in to the Prisma Access portal to receive their initial configuration and gateway location.
    Loopback IP addresses
    This address is the source IP address used by Prisma Access for requests made to an internal source, and is assigned from the infrastructure subnet. Add the loopback IP address to an allow list in your network to give Prisma Access access to internal resources such as RADIUS or Active Directory authentication servers.
    Palo Alto Networks recommends that you allow all the IP addresses of the entire infrastructure subnet in your network, because loopback IP addresses for mobile users can change. To find the infrastructure subnet, select
    Panorama
    Cloud Services
    Status
    Network Details
    Service Infrastructure
    . The subnet displays in the
    Infrastructure Subnet
     area.
    To retrieve loopback IP addresses, use the legacy API command.
    Remote Network
    Remote Network IP addresses (
    remote_network
    )
    Includes
    Service IP Addresses
     that Prisma Access assigns for the Prisma Access remote network connection, and egress IP addresses that Prisma Access uses to make sure that remote network users get the correct default language for their region. Add these addresses to allow lists in your network to give Prisma Access access to internet resources.
    Loopback IP addresses
    This is the source IP address used by Prisma Access for requests made to an internal source, and is assigned from the infrastructure subnet. Add the loopback IP address to an allow list to give Prisma Access access to internal resources such as RADIUS or Active Directory authentication servers. To retrieve loopback IP addresses, use the legacy API command.
    Clean Pipe
    Clean Pipe IP Addresses (
    clean_pipe
    )
    If you have a Clean Pipe deployment, add these IP addresses to an allow list to give the Clean Pipe service access to internet resources.
    Loopback IP addresses
    This is the source IP address used by Prisma Access for requests made to an internal source, and is assigned from the infrastructure subnet. Add the loopback IP address to an allow list to give Prisma Access access to internal resources such as RADIUS or Active Directory authentication servers. To retrieve loopback IP addresses, use the legacy API command.

    API Script Used to Retrieve IP Addresses

    Use the following steps to retrieve the IP addresses that Prisma Access uses in its infrastructure.
    This command does not retrieve loopback addresses; to retrieve loopback IP addresses, use the loopback API command.
    1. Get the API key.
      You need this key to authenticate to Prisma Access and retrieve the list of IP addresses using the API command. Only a Panorama administrator or Superuser can generate or access this API key.
      1. Select
        Panorama
        Cloud Services
        Configuration
        Service Setup
        .
      2. Select
        Generate API Key
        .
        generate-api-key.png
        If you have already generated an API key, the
        Current Key
         displays. If you haven’t yet generated a key or want to replace the existing key to meet audit or compliance check for key rotation, click
        Generate New API Key
         for a new key.
    2. Create a .txt file and put the API command options in the file.
      Using the API the command to use is a two-step process. First, you create a .txt file, specifying the parameters for the IP addresses to retrieve, and save the file in a folder that is reachable from the location where you run the command. Then, you run the API and specify the name and location of the .txt file you created in the command.
      Specify the following keywords and arguments in the .txt file. See API Command Examples for examples. The examples in this document use a file name of
      options.txt
       but you can specify any file name, as long as you reference it in the command.
      Argument
      Possible choices (keywords)
      Comments
      serviceType
      all
      remote_network
      gp_gateway
      gp_portal
      clean_pipe
      all
      —Retrieves IP addresses you need to add to an allow list for all service types (Remote Networks, Mobile Users (both gateways and portals), and Clean Pipe, as applicable to your deployment).
      remote_network
      —Retrieves IP addresses you need to add to an allow list for remote network deployments.
      gp_gateway
      —Retrieves the gateway IP addresses you need to add to an allow list for mobile user deployments.
      gp_portal
       —Retrieves the portal IP addresses you need to add to an allow list for mobile user deployments.
      clean_pipe
      —Retrieves the IP addresses you need to add to an allow list for clean pipe deployments.
      addrType
      all
      active
      reserved
      all
      —Retrieves all the IP addresses you need to add to an allow list.
      active
      —Retrieves the active IP addresses. This keyword is applicable to mobile user deployments only.
      reserved
      —Retrieves the reserved IP addresses. This keyword is applicable to mobile user deployments only.
      This API does not retrieve loopback IP addresses. To retrieve loopback IP addresses, use the legacy API command.
      location
      all
      deployed
      all
      —Retrieves the IP addresses from all locations. For mobile user deployments, this keyword retrieves the IP addresses for both locations you added during onboarding, and locations you did not add.
      deployed
      —Retrieves IP addresses in all locations that you added during mobile user onboarding.
      This keyword is applicable to mobile user deployments only. Prisma Access associates IP addresses for every mobile user location during provisioning, even if you didn’t select that location during mobile user onboarding. If you specify
      all
      , the API command retrieves the IP addresses for all mobile user locations, including ones you didn’t select for the deployment. If you specify
      deployed
      , the API command retrieves only the IP addresses for the locations you selected during onboarding.
      Specify the options in the .txt file in the following format:
      {
   "serviceType": "
      service-type
      ",   
   "addrType": "
      address-type
      ",
   "location": "
      location
      "
   }
    3. Enter the following command to retrieve the IP addresses:
      curl -X POST --data @
      option.txt
       -k -H header-api-key:Current-API-Key 
      Current-API-Key
       "https://api.gpcloudservice.com/getPrismaAccessIP/v2"
      Where
      option.txt
       is the .txt file you created in Step 2 and
      Current-API-Key
       is the Prisma Access API key.
      For example, given a .txt file name of
      option.txt
       and an API key of
      12345abcde
      , use the following API command to retrieve the public IP address for all locations:
      curl -X POST --data @option.txt -k -H header-api-key:12345abcde "https://api.gpcloudservice.com/getPrismaAccessIP/v2"
      The API command returns the addresses in the following format:
      {"status": "success","result": [{"zone": "Colombia","addresses": ["101.1.2.4"]},{"zone": "Argentina","addresses": ["101.1.2.5"]},{"zone": "Brazil Central","addresses": ["101.1.2.3"]}]}
      If there are any problems with the options in the .txt file, the API returns an error similar to the following:
      {"status": "error","result": "Invalid json format in the request. trace_id: xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx "}
    4. Update the allow lists on your on-premises servers or SaaS application policy rules with the IP addresses you retrieved.

    API Command Examples

    Use the following examples when entering keywords and arguments in the .txt file for the API command. To change the output of the command, change the options in the .txt file; the command itself does not change.
    Retrieve These IP Addresses
    Specify These Parameters in the .txt File
    Comments
    Mobile User IP Addresses
    All active and reserved mobile user IP Addresses
    {
"serviceType": "gp_gateway",
"addrType": "all",
"location": "all"
   }
    An
    addrType
     of
    all
     means that Prisma Access retrieves both active and reserved IP addresses for the locations you selected during mobile user onboarding.
    A
    location
     of
    all
     means that Prisma Access retrieves IP addresses for all available locations, including ones that you have not onboarded. Prisma Access reserves non-onboarded location IP addresses so that you can add these IP addresses to your allow lists before you onboard them.
    Active and reserved IP addresses for onboarded mobile user locations
    {
"serviceType": "gp_gateway",
"addrType": "all",
"location": "deployed"
   }
    A
    location
     type of
    deployed
     means that Prisma Access retrieves only the IP addresses for the locations that you selected during mobile user onboarding.
    All active IP Addresses for onboarded mobile user locations
    {
"serviceType": "gp_gateway",
"addrType": "active",
"location": "deployed"
   }
    An
    addrType
     of
    active
     means that Prisma Access retrieves only the active IP addresses, and does not retrieve reserved IP addresses, for the locations you onboarded.
    All reserved IP Addresses for onboarded mobile user locations
    {
"serviceType": "gp_gateway",
"addrType": "reserved",
"location": "deployed"
   }
    An
    addrType
     of
    reserved
     means that Prisma Access retrieves only the reserved IP addresses for the locations you onboarded.
    Do not use an
    addrType
     of
    reserved
     with a
    location
     of
    all
    ; Prisma Access does not allocate active and reserved IP addresses to locations that you have not onboarded.
    Remote Network IP Addresses
    Retrieve all remote network IP addresses
    {
"serviceType": "remote_network",
"addrType": "all",
"location": "all"
   }
    This command retrieves the public and egress IP addresses of remote networks you have onboarded. Do not use a
    location
     of
    deployed
     or an
    addrType
     of
    reserved
    . You can use an
    addrType
     of
    active
     but it retrieves the same addresses as if you specified an
    addrType
     of
    all
    .
    Clean Pipe IP Addresses
    Retrieve all clean pipe IP addresses
    {
"serviceType": "clean_pipe",
"addrType": "all",
"location": "all"
   }
    This command retrieves the public and egress IP addresses of clean pipes you have onboarded. Do not use a
    location
     of
    deployed
     or an
    addrType
     of
    reserved
    . You can use an
    addrType
     of
    active
     but it retrieves the same addresses as if you specified an
    addrType
     of
    all
    .

    Be Notified of Changes to IP Addresses

    To be notified of public IP address changes for remote networks and loopback IP address changes for service connections, remote network connections, and mobile users, you can to specify a URL at which you can be alerted of a change. Prisma Access uses an HTTP POST request to send the notification. This POST request includes the following notification data in JSON format: 
    {"addrType": "public_ip", "addrChangeType": "add", "utc_timestamp": "2019-01-31 23:08:19.383894", "text": "Address List Change Notification"}
    {"addrType": "public_ip", "addrChangeType": "delete", "utc_timestamp": "2019-01-31 23:13:35.882151", "text": "Address List Change Notification"}
    {"addrType": "loopback_ip", "addrChangeType": "update", "utc_timestamp": "2019-01-31 23:29:27.100329", "text": "2018-05-11 23:29:27.100329"}
    When you receive a notification, you must follow a two-step process. First, you must manually or programatically retrieve the IP or loopback addresses. Then, you must update the IP addresses in your organization’s appropriate allow list to ensure that users do not experience any disruption in service.
    Prisma Access sends this notification a few seconds before the new IP address becomes active. We recommend that you use automation scripts to both retrieve and add the new IP addresses to an allow list in your network.
    To add an IP notification URL, complete the following task.
    1. Select
      Panorama
      Cloud Services
      Configuration
      Service Setup
      .
    2. Add an
      IP Change Event Notification URL
       where you can be notified of IP address changes in your Prisma Access infrastructure.
      notification-url.png
      You can specify an IP address or an FQDN to an HTTP or HTTPS web service that is listening for change notifications. Prisma Access sends these notifications from the internet using a public IP address.
      You do not need to commit your changes for the notification URL to take effect.

    Legacy Scripts Used to Retrieve IP and Loopback Addresses

    The commands described in this section are superseded as of Prisma Access 1.5; however, they are still supported for when you need to obtain the loopback address, or for deployments that use them in scripts or other automated tools.
    The following table shows the keywords and parameters that are available in the legacy API scripts used with Prisma Access, and provides information and recommendations about which API to use for the type of deployment you have.
    These legacy commands retrieve two types of IP addresses,
    public IP
     and
    egress IP
     addresses. We provide you with two different legacy API commands so that you can retrieve all the IP addresses you need to add to an allow list.
    • A
      public IP address
       is the source IP address that Prisma Access uses for requests made to an internet-based source. Add the public IP address to an allow list in your network to give Prisma Access access to internet resources such as SaaS applications or publicly accessible partner applications.
      Mobile user, remote network, and clean pipe deployments use public IP addresses.
    • An
      egress IP address
       is an IP address that Prisma Access uses for egress traffic to the internet, and you must also add these addresses to an allow list to give Prisma Access access to internet resources.
      Among other purposes, Prisma Access uses egress IP addresses so that users receive web pages in the language they expect from a Prisma Access location. All locations have public IP addresses; however, not all locations have egress IP addresses. The following locations do not use egress IP addresses:
      • Any locations that you added before the release of Prisma Access 1.4.
      • Bahrain
      • Belgium
      • France North
      • France South
      • Hong Kong
      • Ireland
      • South Korea
      • Taiwan
      • United Kingdom
      Mobile user, remote network, and clean pipe deployments use egress IP addresses.
    Commands Used in Mobile User Deployments
    Command Name
    Comments
    get_egress_ip_all=yes
     command
    curl -k -H header-api-key:
    Current-API-Key
    "https://api.gpcloudservice.com/getAddrList/latest?get_egress_ip_all=yes
    This command retrieves all the IP addresses that you add to an allow list to give Prisma Access access to internet resources such as SaaS applications or publicly accessible partner applications. This command has the following constraints:
    • This command can retrieve a large number of addresses (more than 200). If your enterprise cannot add this number of IP addresses to an allow list, you can use the
      gpcs_gp_gw
       and
      gpcs_gp_portal
       keywords to retrieve only the IP addresses you are currently using; however you will have to rerun these commands every time you add a location. In addition, if a scaling event occurs, you will need to the new IP addresses to an allow list.
    • Prisma Access does not list the locations that are associated with these IP addresses; therefore, we recommend that you all the IP addresses that are returned with this command to an allow list.
    • This command does not give you loopback addresses.
    gpcs_gp_gw
     and
    gpcs_gp_portal
     keywords
    curl -k -H header-api-key:
    Current-API-Key
    "https://api.gpcloudservice.com/getAddrList/latest?fwType=
    gpcs_gp_gw
     |
    gpcs_gp_portal
    &addrType=
    public_ip
     |
    egress_ip_list
     |
    loopback_ip
    "
    Use this command if your deployment limits the amount of IP addresses you can add to an allow list. You must add all IP addresses returned with this command to an allow list in your network. You can also retrieve the loopback IP addresses with this command.
    This command has the following limitations:
    • It doesn’t list any of the reserved IP addresses used for scaling events.
    • It doesn’t list any of the reserved IP addresses used for locations that you haven’t yet added.
    Commands Used In Remote Network Deployments
    Command Name
    Comments
    gpcs_remote_network
     keyword
    curl -k -H header-api-key:
    Current-API-Key
    "https://api.gpcloudservice.com/getAddrList/latest?fwType=
    gpcs_remote_network
    &addrType=
    public_ip
     |
    egress_ip_list
     |
    loopback_ip
    "
    Use this command to find the IP addresses that you need to add to an allow list for remote network deployments.
    You can also use this command to find the egress IP addresses for remote network deployments; the egress and IP addresses can be different in some situations.
    Commands Used in Clean Pipe Deployments
    Command Name
    Comments
    gpcs_clean_pipe
     keyword
    curl -k -H header-api-key:
    Current-API-Key
    "https://api.gpcloudservice.com/getAddrList/latest?fwType=
    gpcs_clean_pipe
    &addrType=
    public_ip
     |
    egress_ip_list
     |
    loopback_ip
    "
    Use this command to find the IP addresses that you need to add to an allow list for clean pipe deployments.

    Retrieve Public and Egress IP Addresses for Mobile User Deployments

    If you are adding public IP addresses to allow lists to give mobile users access to SaaS or public applications, Prisma Access provides two sets of public IP and egress IP addresses so that it can automatically add locations during a scaling or other event (for example, when a large number of mobile users join a single gateway):
    • One set that is assigned to Prisma Access locations and portals that are currently active.
    • Another set to reserve in case of a scaling event, infrastructure upgrade, or other event that causes Prisma Access to add locations, portals, or both.
    You can then add this reserved set of IP addresses to an allow list before they are used, preventing any issues with mobile users being able to access SaaS or public applications during a scaling event. See IP Address Allocation For Mobile Users for more information about the IP allocation process.
    Retrieve these new addresses by completing the following task:
    1. Get the API key by selecting
      Panorama
      Cloud Services
      Configuration
      Service Setup
      ; then, selecting
      Generate API Key
      .
      You need this key to authenticate to Prisma Access and retrieve the list of IP addresses using the curl command listed below. Only a Panorama administrator or Superuser can generate or access this API key.
    2. Enter the following command to retrieve the mobile user public IP addresses:
      curl -k -H header-api-key:
      Current-API-Key
       "https://api.gpcloudservice.com/getAddrList/latest?get_egress_ip_all=yes"
      Where
      Current-API-Key
       is the Prisma Access API key.
      For example, given an API key of
      12345abcde
      , use the following API command to retrieve the public IP address for all locations:
      curl -k -H header-api-key:12345abcde "https://api.gpcloudservice.com/getAddrList/latest?get_egress_ip_all=yes"
      Every time Prisma Access uses the reserved set of public IP addresses, it allocates another set of reserved IP addresses. If you think that Prisma Access has used the reserved set of public IP addresses (for example, if a large number of mobile users have accessed a single location), you can run this API command again to find the new set of reserved public IP addresses. All IP addresses persist after an upgrade.

    Retrieve Public, Loopback, and Egress IP Addresses

    To retrieve public, loopback, and egress IP addresses, complete the following steps.
    1. Get the API key and add an
      IP Change Event Notification URL
       where you can be notified of IP address changes in your Prisma Access infrastructure.
    2. Retrieve the public IP addresses, loopback IP addresses, or both for Prisma Access.
      Use the API key and the API endpoint URL either manually or in an automation script: 
      header-api-key:
      Current
API Key
       "https://api.gpcloudservice.com/getAddrList/latest?fwType=
      $fwType
      &addrType=
      $addrType
      "
      where you need to replace Current API Key with your API key and use one or both of the following keywords and arguments:
      Keyword
      Description
      fwType
       keyword
      gpcs_gp_gw
      Retrieves Prisma Access gateway IP addresses (for mobile user deployments).
      gpcs_gp_portal
      Retrieves Prisma Access portal IP addresses (for mobile user deployments).
      gpcs_remote_network
      Retrieves Prisma Access remote network IP addresses (for remote network deployments).
      gpcs_clean_pipe
      Retrieves Prisma Access Clean Pipe IP addresses.
      addrType
       keyword
      public_ip
      Retrieves the source IP addresses that Prisma Access uses for requests made to an internet-based source.
      For mobile user locations, Prisma Access lists the IP addresses by location. For remote networks, Prisma Access lists the IP addresses by remote network name.
      egress_ip_list
      Retrieves the IP addresses that Prisma Access uses with public IP addresses for additional egress traffic to the internet.
      For mobile user locations, Prisma Access lists the IP addresses by location. For remote networks, Prisma Access lists the IP addresses by remote network name.
      loopback_ip
      Retrieves the source IP addresses used by Prisma Access for requests made to an internal source (for example, a RADIUS or Active Directory server), and is assigned from the infrastructure subnet.
      If you don’t specify a keyword, Prisma Access retrieves all IP addresses.
      For example, you can try the following Curl command to manually retrieve the list of public IP addresses for all remote networks: 
      curl -k -H header-api-key:1234y9ydxb__0UmxetVTbC8XTyFMaoT4RBZBKBjfX419YVufeFG7 "https://api.gpcloudservice.com/getAddrList/latest?fwType=gpcs_remote_network&addrType=public_ip"
      or use a simple python script to retrieve the list of all IP addresses, for example:
      #!/usr/bin/python
import subprocess
import json
api_key = '1234y9ydxb__0UmxetVTbC8XTyFMaoT4RBZBKBjfX419YVufeFG7' # Replace with your key
api_end_point = 'https://api.gpcloudservice.com/getAddrList/latest' # This call retrieves IP addresses for all your Prisma Access firewalls
args = ['curl', '-k', '-H', 'header-api-key:' +  api_key, api_end_point]
p = subprocess.Popen(args, stdout=subprocess.PIPE)
output = p.communicate()
dout = json.loads(output[0])
addrStrList = dout['result']['addrList']
addrList = []
for addr_str in addrStrList:
    addrList.append(addr_str.split(":")[1])
print(addrList)
    3. Update the allow lists on your on-premises servers or SaaS application policy rules with the IP addresses you retrieved.

    Recommended For You

    Recommended Videos

    Recommended videos not found.

    © 2020 Palo Alto Networks, Inc. All rights reserved.

    Techdocs Logo