Enable access to Palo Alto Networks resources

Depending on your network environment settings, you may need to enable network access to the Cortex AgentiX resources.

After you receive your account details, in your firewall configuration, enable and verify access to Cortex AgentiX communication servers, storage buckets, and various resources.

Some of the IP addresses required for access are registered in the United States. As a result, some GeoIP databases do not correctly pinpoint the location from which IP addresses are used. All customer data is stored in your deployment region, regardless of the IP address registration, and data transmission is restricted through any infrastructure to that region.

For IP address ranges in Google Cloud Platform (GCP), view the following tables for IP address coverage for your deployment:

• https://www.gstatic.com/ipranges/goog.json: IP address subnet ranges
• https://www.gstatic.com/ipranges/cloud.json: IP address ranges associated with your region

In your firewall configuration, enable the following resources:

FQDN	Description
\<agentix-tenant>.xdr.\<region>.paloaltonetworks.com	Used to connect to Palo Alto Networks. For the relevant region and IP address, see the IP Address to connect to Cortex AgentiX column below. For example, if the region is US, use the 35.244.250.18 IP address.
api-\<agentix-tenant>.xdr.\<region>.paloaltonetworks.com	Used for API requests and responses and to connect to an engine. For the relevant region and IP address, see the API/EDL IP Address column below. For example, if the region is US, use the 35.222.81.194 IP address.
ext-\<agentix-tenant>.xdr.\<region>.paloaltonetworks.com	Used for EDL (long-running integrations). For the relevant region and IP address, see the API/EDL IP Address column below. For example, if the region is US, use the 35.222.81.194 IP address.

<agentix-tenant> refers to the chosen subdomain of your Cortex AgentiX tenant, and <region> is the region in which your tenant is deployed.

The port is 443.

Egress is used for communication between Cortex AgentiX and customer resources.

Region	IP Address to connect to Cortex AgentiX	API/EDL IP Address	Outbound IPs for engines
AU (Australia)	34.120.229.65	35.189.18.208	35.244.73.76 35.201.22.63
CA (Canada)	34.120.31.199	35.203.82.121	35.203.57.162 35.203.90.79
DE (Germany)	34.98.68.183	34.107.57.23	34.107.83.197 34.159.53.97
EU (Europe - Netherlands)	35.227.237.180	34.90.67.58	34.147.67.188 34.90.16.31
FA (France)	34.111.134.57	34.155.222.152	34.155.197.131 34.155.5.100
IN (India)	35.186.207.80	35.200.158.164	34.93.118.113 35.244.5.205
JP (Japan)	35.241.28.254	34.84.125.129	34.146.60.215 34.84.93.160
KR (South Korea)	34.54.5.247	34.64.54.175	34.64.189.205 34.64.45.118
SG (Singapore)	34.117.211.129	34.87.83.144	35.240.144.192 35.240.255.15
UK (United Kingdom)	34.120.87.77	34.89.56.78	34.142.3.42 34.142.44.136
US (United States)	35.244.250.18	35.222.81.194	35.225.156.101 34.69.88.119

In-app Help Center and notifications

FQDN	IP Addresses and Port
data.pendo.io	Port: 443
pendo-static-5664029141630976.storage.googleapis.com	Port: 443

Email notifications

IP address for all regions: 159.183.150.248

App login and authentication

FQDN	IP address and port
https://sso.paloaltonetworks.com	Port: 443

Required Resources for Federal (United States - Government)

FQDN	IP Addresses and Port
app-proxy.federal.paloaltonetworks.com	IP address: 35.186.217.42 Port: 443
api-<xsoar-tenant>.crtx.federal.paloaltonetworks.comUsed for API requests and responses.	IP address: 130.211.195.231 Port: 443
Outbound IPs for XSOAR SaaS Engines	​
​	FedRAMP Moderate 34.123.127.174:443 34.71.135.18:443 FedRAMP High 34.123.153.175:443 35.223.253.2:443
App Login and Authentication	​
sso-fed.paloaltonetworks.com	Port: 443