Pre-Allocate IP Addresses for Prisma Access Mobile User Locations
Focus
Focus

Pre-Allocate IP Addresses for Prisma Access Mobile User Locations

Table of Contents

Pre-Allocate IP Addresses for Prisma Access Mobile User Locations

Learn how to pre-allocate IP addresses so you can add them to your allow lists.
Prisma Access uses gateway and portal IP addresses for Mobile Users—GlobalProtect deployments, and authentication cache service (ACS) and network load balancer IP addresses for Mobile Users—Explicit Proxy deployments. Mobile Users—GlobalProtect IP addresses are known as egress IP addresses. If you need to pre-allocate mobile user IP addresses before you onboard the location (for example, if your organization needs to add the IP addresses for Mobile Users—GlobalProtect deployments to allow lists to give mobile users access to external SaaS applications), you can run an API script to have Prisma Access pre-allocate these IP addresses for a location ahead of time, before you onboard it. You can then add the location’s egress IP addresses to your organization’s allow lists before onboarding the location.
The API response also includes the public IP subnets for the egress IP addresses for the requested location. The egress IP addresses of any locations you add are a part of this subnet. Adding the subnets to your allow lists provides for future location additions without further allow list modification.
Prisma Access does not pre-allocate your IP addresses and subnets unless you request them using the API script. After you run the pre-allocation script, they have a validity period of 90 days. The IP addresses that Palo Alto Networks provides you are unique, not shared, and dedicated to your Prisma Access deployment during the validity period. You must onboard your locations before the validity period ends or you lose the addresses; to find the validity period at any time, run the API script.
Palo Alto Networks recommends that you only pre-allocate IP addresses for locations that you want to onboard later.
To pre-allocate IP addresses, complete the following task.
  1. Retrieve the Prisma Access API key.
  2. Pre-allocate the mobile user egress IP addresses by creating a .txt file and specifying the following options in the .txt file you create.
    Enter the following text in the .txt file:
    • Mobile Users—GlobalProtect Deployments:
        {
         "actionType": "pre_allocate",   
         "serviceType": "gp_gateway",
         "location": ["location"]
         }
    • Mobile Users—Explicit Proxy Deployments:
      {
      "actionType": "pre_allocate",
      "serviceType": "swg_proxy",
      "location": ["location"]}
    Where location is the Prisma Access location or locations where you want to pre-allocate the IP addresses. If you enter multiple locations, use brackets around the set of locations and separate each location entry with quotes, a comma, and a space (for example, ["location1", "location2", "location3"], and so on).
    Enter a maximum of 12 locations. Entering more than 12 locations might cause timeout errors when Prisma Access retrieves the pre-allocated IP addresses.
  3. Enter the CURL command as shown in Step 3 in Run the API Script Used to Retrieve Prisma Access IP Addresses.
  4. Retrieve the IP addresses and subnets you requested, including their validity period, by re-opening the .txt file, removing the existing information, and editing it.
    • Mobile Users—GlobalProtect Deployments:
      • To request Prisma Access to retrieve all pre-allocated IP addresses, enter the following text in the .txt file.
          {
           "serviceType": "all",   
           "addrType": "pre_allocated",
           "location": "all"
           }
      • To request Prisma Access to retrieve all pre-allocated IP addresses for Prisma Access gateways for a given location, enter the same information in the .txt file but substitute all with gp_gateway in the .txt file.
      • To request Prisma Access to retrieve all pre-allocated IP addresses for Prisma Access portals for a given location, enter the same information in the .txt file but substitute all with gp_portal in the .txt file.
    • Mobile Users—Explicit Proxy Deployments:
      To request that Prisma Access pre-allocate all IP addresses you need to add to allow lists for an explicit proxy deployment, enter the following text in the .txt file.
      {
      "actionType": "pre_allocate",
      "serviceType": "swg_proxy",
      "location": ["all"]
      }
    Palo Alto Networks recommends that you enter all so you can retrieve all required pre-allocated egress IP addresses to add to your allow lists.
    For Mobile Users—GlobalProtect deployments, while Prisma Access returns up to four addresses for each location (two gateway IP addresses and, if required, two portal IP addresses), the API command can return a large amount of information. To make the output more readable, if you have Python installed, you can add | python -m json.tool at the end of the CURL command.
  5. Re-enter the CURL command as shown in Step 3 in Run the API Script Used to Retrieve Prisma Access IP Addresses to retrieve the pre-allocated addresses.
    Prisma Access returns the information in the following format:
        "result": [
           {
                "zone": "prisma-access-zone1",
                "addresses": [
      ["ip-address1","ip-address2"]
                "zone_subnet" :  
      [subnet-and-mask1","subnet-and-mask2"]
                "address_details":[
                              {"address":"ip-address1",
                               "service_type":"service-type",                         
                                "addressType":"pre-allocated",
                               "expiring_in" : "validity-period" },
                              {"address":"ip-address2",
                               "service_type":"gp_gateway",
                               "addressType":"pre-allocated",
                               "validity_period_remaining" : "90 days" } ,        
             },        
    Where the variables represent the following API command output:
    VariableExplanation
    prisma-access-zone1
    The Prisma Access location for which pre-allocated IP addresses were retrieved.
    ip-address1 and ip-address2
    The egress IP addresses that Prisma Access has pre-allocated for the specified location.
    Prisma Access retrieves two IP addresses for each location; you must add both of these IP addresses to your allow lists.
    subnet-and-mask1 and subnet-and-mask2
    The subnets that Prisma Access has pre-allocated and reserved for the egress IP addresses in your deployment.
    service-type
    The type of the pre-allocated egress IP address (either gp_portal for a Prisma Access portal or gp_gateway for a Prisma Access gateway).
    validity-period
    The remaining time, in days, for which the pre-allocated IP address is valid.
    You must onboard your mobile user location before the IP addresses’ validity period ends. If the pre-allocated IP addresses expire, you can rerun the API script to retrieve another set of pre-allocated IP addresses.
    You could receive an error if you attempt to pre-allocate IP addresses for locations that meet one of the following criteria:
    • You have already onboarded the location.
    • You onboarded, then deleted the location.
      In this case, enter the following text in the .txt file to retrieve the Mobile Users—GlobalProtect IP addresses for the location:
        {
      "serviceType": "gp_gateway",
      "addrType": "all",
      "location": "all"
         }
    • You have reached the maximum number of mobile user locations allowed by your license and cannot add any more locations.
    • You entered the location name incorrectly.
    • You entered a serviceType other than gp_gateway.
    • you entered an actionType other than pre_allocate.