>
    Strata Copilot
    Strata Cloud Manager Prerequisites for NGFW and VM-Series Funded by Software NGFW Credits
    Focus
    Download PDF
    Focus
    1. Home
    2. Strata Cloud Manager
    3. Strata Cloud Manager Activation & Onboarding
    4. Strata Cloud Manager Prerequisites
    5. Strata Cloud Manager Prerequisites for NGFW and VM-Series Funded by Software NGFW Credits
    Download PDF
    Strata Cloud Manager

    Strata Cloud Manager Prerequisites for NGFW and VM-Series Funded by Software NGFW Credits

    Table of Contents

    Strata Cloud Manager Prerequisites for NGFW and VM-Series Funded by Software NGFW Credits

    Learn about Strata Cloud Manager prerequisites for NGFWs.
    Strata Cloud Manager provides comprehensive visibility and insights for your Palo Alto Networks Next-Generation Firewalls (NGFW) deployments, whether managed by Strata Cloud Manager or Panorama. You can onboard your NGFW to Strata Cloud Manager to manage and gain insights. If you already have NGFWs managed by Panorama, you can connect Strata Cloud Manager to your Panorama using the Panorama CloudConnector Plugin.
    When preparing to onboard and manage your NGFW and VM-Series funded by software NGFW credits through Strata Cloud Manager, ensure that the necessary prerequisites are met. This section covers the essential areas for successful onboarding, including connectivity requirements and supported regions.
    • Cloud Management for NGFWs Onboarding Prerequisites - Before onboarding your NGFW to Strata Cloud Manager, verify that all conditions for device readiness are fulfilled. This includes network configuration, software compatibility, and licensing requirements. Completing these steps ensures that your firewall can be successfully managed using Strata Cloud Manager.
      To onboard VM-series funded by software NGFW credits, see Create a Deployment Profile.
    • Device Model Compatibility - Device models that you can associate with Strata Cloud Manager.
    • TCP Ports and FQDNs Required for Cloud Management of NGFWs - To enable seamless communication between the NGFW and Strata Cloud Manager, configure specific TCP ports and Fully Qualified Domain Names (FQDNs).
    • Enable Telemetry on Devices - Enable telemetry on your NGFW to allow Strata Cloud Manager to collect necessary data for insights and recommendations. Strata Cloud Manager assesses the health of the devices in your deployment by analyzing telemetry data that your PAN-OS devices send to Strata Logging Service.
    • Create Device Labels - Use Device Labels in Strata Cloud Manager to automate and streamline NGFW onboarding and management processes.
    • Create a Device Onboarding Rule - Use device onboarding rules to automate parts of the NGFW onboarding process for Strata Cloud Manager.

    Cloud Management for NGFWs Onboarding Prerequisites

    Review the requirements to onboard a Strata Cloud Manager tenant and firewalls to Strata Cloud Manager.
    Note that some requirements, such as PAN-OS Version, Firewall Model, Ports, and Services, apply to the firewall. While others, such as the Logging and Authentication service requirements, apply to your Customer Support Portal (CSP) account.
    Prerequisite
    Supported
    Required?
    PAN-OS Version
    (minimum)PAN-OS 10.2.3
    Yes
    Firewall Model
    Single vsys firewalls only
    Multi-vsys firewalls are not supported
    PA-410 not supported if Enterprise DLP license is active
    PA-220 and PA-220R
    PA-400 Series
    PA-450R, PA-455R, and PA-455R-5G
    PA-500 Series
    PA-800 Series
    PA-1400 Series
    PA-3200 Series
    PA-3400 Series
    PA-5200 Series
    PA-5400 Series
    PA-5500 Series
    PA-7000 Series
    PA-7500
    VM-Series
    N/A
    Device Certificates
    The device certificate must be installed on NGFWs before onboarding to Strata Cloud Manager.
    Some NGFW models automatically install the device certificate when you first register the device on the support portal. For others, you need to manually install device certificates before onboarding.
    For any NGFW models with expired certificates, you must manually renew the certificates before onboarding.
    Yes
    Whether you need to manually install the device certificate before onboarding depends on your NGFW model, or the status of your device certificates.
    Ports
    Ports are used for outbound communication from the firewall to Strata Cloud Manager and SLS
    443
    444
    3978
    Yes
    Services
    Services are used for resolution of the Strata Cloud Manager tenant, as well as software and content updates
    DNS
    NTP
    Yes
    Firewall Onboarding
    AIOps for NGFW (Premium)
    (Optional) Zero Touch Provisioning (ZTP)
    Yes
    ZTP onboarding is optional
    Firewall Management
    Strata Cloud Manager
    Yes
    Account Administrator or App Administrator hub roles
    Logging
    Strata Logging Service
    Yes
    Data Filtering
    Enterprise data loss prevention (DLP)
    No
    Routing
    Advanced Routing Engine
    Enabled by default during onboarding
    Yes
    SaaS Application Management
    Next-Generation CASB
    No

    TCP Ports and FQDNs Required for Cloud Management of NGFWs

    Review the TCP ports and Fully Qualified Domain Names (FQDN) that you must enable on your network communication and between the Palo Alto Networks Next-Gen Firewall (NGFW) and Strata Cloud Manager. Communication on these TCP ports and FQDNs must allowed on your network to successfully manage your firewalls from Strata Cloud Manager.

    Connections to Strata Cloud Manager

    You must allow the following app, FQDNs, and TCP ports on your network to enable connectivity between the firewall and Strata Cloud Manager.
    The Virtus service is a device connectivity service that facilitates the connection between the firewall and Strata Cloud Manager. The FQDN and/or IP address for the region where your Strata Cloud Manager tenant is deployed must be allowed on your network for the firewall to successfully connect to Strata Cloud Manager. The firewall cannot connect to Strata Cloud Manager if the FQDN or IP address is blocked.
    Required App-ID and Port for Strata Cloud Manager
    App-ID
    TCP Port
    panorama
    3978
    Required FQDNs, IP Addresses, and Ports for Strata Cloud Manager
    Service
    FQDN
    IP Address
    TCP Ports
    OCSP
    N/A
    80
    Virtus
    Australia—*.aus.ngfw.cloudmgmt.paloaltonetworks.com
    34.151.118.202
    3978
    443
    Canada—*.ca.ngfw.cloudmgmt.paloaltonetworks.com
    34.118.139.11
    E.U—*.eu.ngfw.cloudmgmt.paloaltonetworks.com
    35.246.199.57
    France—*.fr.ngfw.cloudmgmt.paloaltonetworks.com
    34.155.195.45
    India—*.in.ngfw.cloudmgmt.paloaltonetworks.com
    35.200.223.12
    Israel —*.il.ngfw.cloudmgmt.paloaltonetworks.com
    34.165.153.154
    Italy—*.it.ngfw.cloudmgmt.paloaltonetworks.com
    34.154.245.218
    Indonesia—*.id.ngfw.cloudmgmt.paloaltonetworks.com
    34.101.126.22
    Japan—*.jp.ngfw.cloudmgmt.paloaltonetworks.com
    34.146.27.93
    Poland—*.pl.ngfw.cloudmgmt.paloaltonetworks.com
    34.118.28.91
    Qatar—*.qa.ngfw.cloudmgmt.paloaltonetworks.com
    34.18.53.154
    Saudi Arabia— *.sa.ngfw.cloudmgmt.paloaltonetworks.com
    34.166.126.37
    Singapore—*.sg.ngfw.cloudmgmt.paloaltonetworks.com
    35.198.210.240
    South Africa—*.za.ngfw.cloudmgmt.paloaltonetworks.com
    34.35.27.12
    Spain—*.es.ngfw.cloudmgmt.paloaltonetworks.com
    34.175.25.27
    Switzerland—*.ch.ngfw.cloudmgmt.paloaltonetworks.com
    34.65.231.25
    U.K—*.uk.ngfw.cloudmgmt.paloaltonetworks.com
    35.246.86.14
    U.S.A—*.us.ngfw.cloudmgmt.paloaltonetworks.com
    34.31.195.141
    Discovery Service
    ds-cloudmgmt.paloaltonetworks.com
    N/A
    443

    Connections to Strata Logging Service

    You must allow the following apps, FQDNs, and TCP ports on your network to forward logs from the managed firewall to Strata Logging Service (SLS). For more details, see the TCP Ports and FQDNs Required for (SLS).
    Required App-ID and Ports for SLS
    App-ID
    TCP Port
    • paloalto-shared-services
    • panorama
    444
    3978
    Required if you’re sending device telemetry data to SLS.
    • paloalto-device-telemetry
    • google-base
    443
    5222-5224
    5228
    5229
    Required FQDNs and Ports for SLS
    Service
    FQDN
    TCP Ports
    OCSP
    80
    SLS Certificates
    3978
    Prisma Access
    *.gpcloudservice.com
    443

    Connections for Firewall Certificates

    You must allow the following FQDNs, and TCP ports on your network to enable your managed firewalls to install the device certificates for Strata Cloud Manager.
    Service
    FQDN
    TCP Ports
    API
    443
    Device Certificates
    443

    © 2026 Palo Alto Networks, Inc. All rights reserved.