> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/deployment-steps/activate-cortex-agentix/enable-access-to-palo-alto-networks-resources.md). # Enable access to Palo Alto Networks resources Depending on your network environment settings, you may need to enable network access to the Cortex AgentiX resources. After you receive your account details, in your firewall configuration, enable and verify access to Cortex AgentiX communication servers, storage buckets, and various resources. {% hint style="info" %} Some of the IP addresses required for access are registered in the United States. As a result, some GeoIP databases do not correctly pinpoint the location from which IP addresses are used. {% endhint %} Data Residency & Transmission: * Data at Rest: All customer data at rest is stored strictly within your selected deployment region. * Standard Deployments: By default, connection endpoints utilize global edge acceleration (Global Load Balancing) to optimize connection performance and volumetric DDoS resilience, with traffic fully encrypted in transit to the deployment region. * Regional Only Compliance Deployments: For organizations with strict local regulatory requirements mandating that network traffic and TLS termination remain strictly within national borders, dedicated Regional Load Balancer endpoints are available upon request. When configured with regional endpoints, all data transmission and TLS handshakes terminate strictly within the specified cloud region. For IP address ranges in Google Cloud Platform (GCP), view the following tables for IP address coverage for your deployment: * : IP address subnet ranges * : IP address ranges associated with your region In your firewall configuration, enable the following resources: | FQDN | Description | | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `\.xdr.\.paloaltonetworks.com` | Used to connect to Palo Alto Networks. For the relevant region and IP address, see the **IP Address to connect to Cortex AgentiX** column below. For example, if the region is US, use the 35.244.250.18 IP address. | | `api-\.xdr.\.paloaltonetworks.com` | Used for API requests and responses and to connect to an engine. For the relevant region and IP address, see the **API/EDL IP Address** column below. For example, if the region is US, use the 35.222.81.194 IP address. | | `ext-\.xdr.\.paloaltonetworks.com` | Used for EDL (long-running integrations). For the relevant region and IP address, see the **API/EDL IP Address** column below. For example, if the region is US, use the 35.222.81.194 IP address. | {% hint style="info" %} `` refers to the chosen subdomain of your Cortex AgentiX tenant, and `` is the region in which your tenant is deployed. The port is 443. {% endhint %} Egress is used for communication between Cortex AgentiX and customer resources. | Region | IP Address to connect to Cortex AgentiX | API/EDL IP Address | Outbound IPs for engines | | ------------------------- | --------------------------------------- | ------------------ | ------------------------------------------------------ | | AU (Australia) | 34.120.229.65 | 35.189.18.208 |
  • 35.244.73.76
  • 35.201.22.63
| | CA (Canada) | 34.120.31.199 | 35.203.82.121 |
  • 35.203.57.162
  • 35.203.90.79
| | DE (Germany) | 34.98.68.183 | 34.107.57.23 |
  • 34.107.83.197
  • 34.159.53.97
| | EU (Europe - Netherlands) | 35.227.237.180 | 34.90.67.58 |
  • 34.147.67.188
  • 34.90.16.31
| | FA (France) | 34.111.134.57 | 34.155.222.152 |
  • 34.155.197.131
  • 34.155.5.100
| | IN (India) | 35.186.207.80 | 35.200.158.164 |
  • 34.93.118.113
  • 35.244.5.205
| | JP (Japan) | 35.241.28.254 | 34.84.125.129 |
  • 34.146.60.215
  • 34.84.93.160
| | KR (South Korea) | 34.54.5.247 | 34.64.54.175 |
  • 34.64.189.205
  • 34.64.45.118
| | SG (Singapore) | 34.117.211.129 | 34.87.83.144 |
  • 35.240.144.192
  • 35.240.255.15
| | UK (United Kingdom) | 34.120.87.77 | 34.89.56.78 |
  • 34.142.3.42
  • 34.142.44.136
| | US (United States) | 35.244.250.18 | 35.222.81.194 |
  • 35.225.156.101
  • 34.69.88.119
| ### **In-app Help Center and notifications** | FQDN | IP Addresses and Port | | ---------------------------------------------------- | --------------------- | | data.pendo.io | Port: 443 | | pendo-static-5664029141630976.storage.googleapis.com | Port: 443 | ### **Email notifications** IP address for all regions: 159.183.150.248 **App login and authentication** | FQDN | IP address and port | | ---------------------------------- | ------------------- | | | Port: 443 | **Required Resources for Federal (United States - Government)** | FQDN | IP Addresses and Port | | ------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `app-proxy.federal.paloaltonetworks.com` |
  • IP address: 35.186.217.42
  • Port: 443
| | `api-`*``*`.crtx.federal.paloaltonetworks.com`Used for API requests and responses. |
  • IP address: 130.211.195.231
  • Port: 443
| | **Outbound IPs for XSOAR SaaS Engines** | ​ | | ​ |

FedRAMP Moderate

  • 34.123.127.174:443
  • 34.71.135.18:443

FedRAMP High

  • 34.123.153.175:443
  • 35.223.253.2:443
| | **App Login and Authentication** | ​ | | `sso-fed.paloaltonetworks.com` | Port: 443 | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/deployment-steps/activate-cortex-agentix/enable-access-to-palo-alto-networks-resources.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.