If you are using a Palo Alto Networks firewall to secure traffic between Panorama, the firewalls, and

Strata Logging Service

, use the following table to identify the App-IDs and ports to which you must allow traffic to ensure that Panorama and the firewalls can successfully connect to

Strata Logging Service

:

For OCSP, you must also allow the firewalls to access ocsp.paloaltonetworks.com on port 80.

On firewalls running PAN-OS 9.1.7 or earlier, you also need a Security policy rule that allows SSL over port 444 to

lic.lc.prod.us.cs.paloaltonetworks.com

.

(

PAN-OS 10.0 or later

) If you are sending telemetry data to

Strata Logging Service

, then, in addition to the above App-IDs and ports (except

paloalto-logging-service

), you must allow the following:

Panorama and Palo Alto Networks firewalls need to access these FQDNs for the initial setup and one-time password, ongoing certificate revocation checks, and certificate renewals.

Additional region-specific FQDNs used by Panorama and Firewall to send logs to Strata Logging Service are available here. If you have another vendor's firewall in between your Palo Alto Networks firewall and

Strata Logging Service

, allow traffic to the FQDNs and ports for your

Strata Logging Service

region.