Edit Advanced IP Defense Connectivity Settings in Strata Cloud Manager

1. Log in to Strata Cloud Manager.
2. Select ConfigurationDevice SettingsCloud Services to edit the Advanced IP Defense connectivity settings.
3. Verify Advanced IP Defense cloud service connectivity status.

   The cloud-managed infrastructure uses an asynchronous fail-open model for cloud lookups. On a cache miss, traffic is allowed to pass and the system queries Advanced IP Defense asynchronously. Once the verdict is returned, the local cache is populated and the policy is enforced on subsequent sessions. If Advanced IP Defense becomes unreachable, the system fails open to prevent a network outage.

   Ensure that network connectivity to Advanced IP Defense endpoints on port 443 is stable. Verify DNS servers are configured and can resolve Advanced IP Defense domain names.
4. (Optional) Select ConfigurationDevice SettingsServices to configure your proxy server settings.

   If your cloud-managed infrastructure is deployed behind a proxy server or in an environment that requires proxy authentication, you must configure proxy settings to enable communication with Advanced IP Defense:

   • Enter the proxy server IP address or FQDN
   • Specify the proxy server port number
   • Enter proxy authentication credentials if required
   • Enable the option to use proxy for inline cloud services

   The proxy server password must contain a minimum of six characters.
5. Verify network connectivity to Advanced IP Defense cloud service endpoints.

   Ensure that your cloud-managed infrastructure has network connectivity to the Advanced IP Defense cloud service endpoints. The infrastructure must be able to reach the Advanced IP Defense cloud service on port 443 (HTTPS) for secure communication.

   You can verify connectivity by:

   • Checking network routing to ensure traffic to Advanced IP Defense cloud service endpoints is not blocked
   • Verifying that security policies allow outbound HTTPS traffic to Advanced IP Defense cloud service IPs
   • Confirming that any proxy servers or firewalls between your infrastructure and the internet allow traffic to Advanced IP Defense.
6. Select ConfigurationDevice SettingsServices and verify that you've configured DNS servers to enable DNS resolution for Advanced IP Defense cloud service endpoints.

   The cloud-managed infrastructure must be able to resolve the Advanced IP Defense domain names to IP addresses. Ensure that your infrastructure has access to DNS servers that can resolve these domain names. You can specify primary and secondary DNS servers to ensure redundancy.
7. Select ConfigurationDevice SettingsServices and click Test Connectivity to verify that the cloud-managed infrastructure can successfully communicate with Advanced IP Defense.

   Palo Alto Networks recommends testing the connectivity after editing the connectivity settings to validate your changes. A successful test confirms that your connectivity settings are correct.
8. Select MonitorSystemCloud Services to monitor Advanced IP Defense connectivity status.

   After enabling Advanced IP Defense, monitor the connectivity status to ensure the cloud-managed infrastructure maintains a stable connection to Advanced IP Defense. Check for any connectivity errors or warnings that may indicate network issues
9. Push your changes.