IP Address Allocation For Mobile Users on Prisma Access
Learn about how Prisma Access allocated IP addresses
for mobile user deployments.
After you deploy Prisma Access for users for the first
time, Prisma Access assigns two public and, if applicable, egress
IP addresses for each portal and gateway. These IP addresses
are unique, not shared, are dedicated to your Prisma Access deployment,
and remain allocated to your tenant until the Prisma Access subscription
expires and the grace period is over.
If you have a multitenant setup, Prisma Access adds dedicated
IP addresses for each tenant.
Since the public IP address is the source IP address used by
Prisma Access for requests made to an internet-based destination,
you may need to know what the public IP address are and add them
to an allow list in your network to provide your users access to
resources such as SaaS applications or publicly-accessible partner
applications.
New public IP addresses can be added to the tenant if the following
events occur:
A large number of mobile users access a location in the
same location.
To address the capacity requirement to service
large number of users, Prisma Access may add one or more gateways,
Prisma Access adds one or more gateways to accommodate the increased
number of users,
assigns one or
more of the existing public IP addresses to the new gateway,
and adds a new set of IP addresses to the mobile user locations
to replace the ones that were used.
You add one or more locations to your deployment.
When
you add more locations, Prisma Access adds another gateway and a
new set of IP addresses for each new location you add.
Because Prisma Access enables more public IP addresses after
a scaling event and after you add a location, you should
add an IP change event
notification URL, or use the API to retrieve mobile user
addresses, to be notified of IP address changes in your Prisma Access
infrastructure. You can then add any added or changed addresses to
an allow list.
