FedRamp and the US Federal Government required resources

Configure required resources for FedRAMP and US federal deployments.

Allow the following resources for United States federal government deployments.

Egress and engine resources

All ports are TCP 443.

Source	Compliance level	IP addresses
Egress	FedRAMP Moderate	34.122.220.113, 35.223.83.172
Egress	FedRAMP High	34.136.155.252, 34.133.46.50
Outbound IPs for Engines	FedRAMP Moderate	34.123.127.174, 34.71.135.18
Outbound IPs for Engines	FedRAMP High	34.123.153.175, 35.223.253.2

Core Cortex XDR communication

All ports are TCP 443.

Function	FQDN	IP address	App-ID
Initial registration	distributions-prod-fed.traps.paloaltonetworks.com	104.198.132.24	traps-management-service
Agent heartbeat and data upload	ch-<tenant-name>.traps.paloaltonetworks.com	130.211.195.231	traps-management-service
EDR data upload	dc-<tenant-name>.traps.paloaltonetworks.com	130.211.195.231	traps-management-service
API gateway	api-<tenant-name>.xdr.federal.paloaltonetworks.com	130.211.195.231	—
Verdict requests	cc-<tenant-name>.traps.paloaltonetworks.com	35.222.50.74	traps-management-service
Live Terminal	wss://lrc-fed.paloaltonetworks.com	35.188.188.91	cortex-xdr
App proxy	app-proxy.federal.paloaltonetworks.com	35.186.217.42	—

Content updates and storage

These GCP resources use TCP port 443.

Function	FQDN	Address	App-ID
Installers	panw-xdr-installers-prod-fr.storage.googleapis.com	GCP ranges	cortex-xdr
Legacy Live Terminal payloads	panw-xdr-payloads-prod-fr.storage.googleapis.com	GCP ranges	cortex-xdr
Content updates	global-content-profiles-policy-prod-fr.storage.googleapis.com	GCP ranges	cortex-xdr
Scanning verdicts	panw-xdr-evr-prod-fr.storage.googleapis.com	GCP ranges	cortex-xdr

Broker VM resources

Allow TCP port 443 unless stated otherwise.

Function	FQDN	Address	App-ID
Broker connection	br-<tenant-name>.xdr.federal.paloaltonetworks.com	34.71.185.11	—
Registration	distributions-prod-fed.traps.paloaltonetworks.com	104.198.132.24	traps-management-service
XDR gateway for Broker VM 3.0 and later	xdr-gateway	FQDN	—
Time synchronization	—	UDP port 123	—

Authentication

Service	FQDN	IP address	App-ID
Identity service	identity.paloaltonetworks.com	34.107.215.35	—
Login service	login.paloaltonetworks.com	34.107.190.184	—

Third-party data collection

Allow inbound traffic from 34.68.217.16 and 34.69.175.202. App-ID coverage is cortex-xdr.

Log forwarding

For syslog forwarding, allow the Cortex XDR IP addresses for your region. See Integrate a syslog receiver.