> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam/enable-access-to-required-panw-resources.md). # Enable access to required PANW resources Configure firewall access to Cortex XSIAM resources using required FQDNs, IP addresses, ports, and App-IDs. After you receive your account details, enable and verify access to Cortex XSIAM communication servers, storage buckets, and other resources in your firewall configuration. Some required IP addresses are registered in the United States. GeoIP databases might not identify their actual usage location. Data Residency & Transmission: * Data at Rest: All customer data at rest is stored strictly within your selected deployment region. * Standard Deployments: By default, connection endpoints utilize global edge acceleration (Global Load Balancing) to optimize connection performance and volumetric DDoS resilience, with traffic fully encrypted in transit to the deployment region. * Regional Only Compliance Deployments: For organizations with strict local regulatory requirements mandating that network traffic and TLS termination remain strictly within national borders, dedicated Regional Load Balancer endpoints are available upon request. When configured with regional endpoints, all data transmission and TLS handshakes terminate strictly within the specified cloud region. Before configuring your firewall, review these guidelines: * Palo Alto Networks App-IDs (firewall policy): If you are using a Palo Alto Networks Firewall, you can simplify your configuration by using App-IDs. If you add the specific App-IDs (for example, `cortex-xdr`, `traps-management-service`) to your firewall security policy, you do not need to allow specific IP addresses listed below manually * App-ID limitations: A dash (—) indicates there is no App-ID coverage for a specific resource. For these rows, you must configure your firewall to allow access based on the IP address and port. * Rule direction: Enable access from the Cortex XDR Agent to the tenant (outbound); this traffic does not need to be bidirectional. * Google Cloud Platform (GCP): For resources listing IP ranges in the GCP, go to the official JSON feeds for the specific IP addresses required for your deployment: * Global subnets: * Regional ranges: * SSL decryption: If you use SSL decryption and experience difficulty connecting the Cortex XDR agent to the server, we recommend that you add the FQDNs required for access to your SSL Decryption Exclusion list in Device → Certificate Management → **SSL Decryption Exclusion**. {% hint style="info" %} ***``*** refers to the selected subdomain of your Cortex XSIAM tenant, and ***``*** is the region in which your tenant is deployed. For more information, see [Cortex XSIAM supported regions](/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam/cortex-xsiam-supported-regions.md). {% endhint %} The following tables list required FQDNs, IP addresses, ports, and App-ID coverage for your deployment.

FQDN	IP Addresses and Port	App-ID Coverage

`<tenant-name>``.xdr.``<region>``.paloaltonetworks.com` Used to send data from external services and systems to the Cortex tenant.	IP address by region: US (United States): 35.244.250.18:443 EU (Europe): 35.227.237.180:443 CA (Canada): 34.120.31.199:443 UK (United Kingdom): 34.120.87.77:443 JP (Japan): 35.241.28.254:443 SG (Singapore): 34.117.211.129:443 AU (Australia): 34.120.229.65:443 DE (Germany): 34.98.68.183:443 IN (India): 35.186.207.80:443 DL (Delhi): 34.8.67.192:443 CH (Switzerland): 34.111.6.153:443 PL (Poland): 34.117.240.208:443 TW (Taiwan): 34.160.28.41:443 QT (Qatar): 35.190.0.180:443 FA (France): 34.111.134.57:443 IL (Israel): 34.111.129.144:443 SA (Saudi Arabia): 35.244.157.127:443 ID (Indonesia): 34.111.58.152:443 ES (Spain): 34.111.188.248:443 IT (Italy): 34.8.224.70:443 KR (South Korea): 34.54.5.247:443 ZA (South Africa): 34.149.165.12:443 BR (Brazil): 34.96.83.202:443 FI (Finland): 34.160.63.63:443	`cortex-xdr`
`distributions.traps.paloaltonetworks.com` Used for the first request in registration flow where the agent passes the distribution id and obtains the `ch-``<tenant-name>``.traps.paloaltonetworks.com` of its tenant.	IP address: 35.223.6.69 Port: 443	`traps-management-service`
`https://lrc-``<region>``.paloaltonetworks.com` `wss://lrc-``<region>``.paloaltonetworks.com` Used in live terminal flow.	IP address by region: US (United States): 35.190.88.43:443 EU (Europe): 35.244.251.25:443 CA (Canada): 35.203.99.74:443 UK (United Kingdom): 35.242.159.176:443 JP (Japan): 34.84.201.32:443 SG (Singapore): 34.87.61.186:443 AU (Australia): 35.244.66.177:443 DE (Germany): 34.107.61.141:443 IN (India): 35.200.146.253:443 DL (Delhi): 34.131.116.135:443 CH (Switzerland): 34.65.213.226:443 PL (Poland): 34.118.62.80:443 TW (Taiwan): 34.80.34.30:443 QT (Qatar): 34.18.34.73:443 FA (France): 34.163.57.57:443 IL (Israel): 34.165.43.106:443 SA (Saudi Arabia): 34.166.54.6:443 ID (Indonesia): 34.101.214.157:443 ES (Spain): 34.175.18.78:443 IT (Italy): 34.154.154.5:443 KR (South Korea): 34.22.66.91:443 ZA (South Africa): 34.35.56.170:443 BR (Brazil): 34.151.236.197:443 FI (Finland): 34.88.31.230:443	`cortex-xdr`
`panw-xdr-installers-prod-us.storage.googleapis.com` Used to download installers for upgrade actions from the server. This storage bucket is used for all regions.	IP ranges in GCP Port: 443	`cortex-xdr`
`panw-xdr-payloads-prod-us.storage.googleapis.com` Used to download the executable for the live terminal for XDR agents earlier than version 7.1.0. This storage bucket is used for all regions.	IP ranges in GCP Port: 443	`cortex-xdr`
`global-content-profiles-policy.storage.googleapis.com` Used to download content updates.	IP ranges in GCP Port: 443	`cortex-xdr`
`panw-xdr-evr-prod-``<region>``.storage.googleapis.com` Used to download extended verdict request results in scanning.	IP ranges in GCP Port: 443	`cortex-xdr`
`https://``<region>``-docker.pkg.dev` Used to download the Kubernetes image from the registry for Kubernetes agents installation. Refer to Regional Docker registry mapping for your specific tenant location and corresponding Docker registry URL.	IP ranges in GCP Port: 443
Regional Docker registry mapping
Tenant location	GCP region	Registry URL
UK Netherlands (EU) United States (US) Canada (CA) South Korea (KR) Singapore (SG) Australia (AU) Japan (JP) India (IN) Germany (DE) France (FR) Finland (FI)	europe-west2 europe-west4 us-central1 northamerica-northeast1 asia-northeast3 asia-southeast1 australia-southeast1 asia-northeast1 asia-south1 europe-west3 europe-west9 europe-north1	europe-west2-docker.pkg.dev europe-west4-docker.pkg.dev us-central1-docker.pkg.dev northamerica-northeast1-docker.pkg.dev asia-northeast3-docker.pkg.dev asia-southeast1-docker.pkg.dev australia-southeast1-docker.pkg.dev asia-northeast1-docker.pkg.dev asia-south1-docker.pkg.dev europe-west3-docker.pkg.dev europe-west9-docker.pkg.dev
`dc-``<tenant-name>``.traps.paloaltonetworks.com` Used for EDR data upload.	IP address by region: US (United States): 34.98.77.231:443 EU (Europe): 34.102.140.103:443 CA (Canada): 34.96.120.25:443 UK (United Kingdom): 35.244.133.254:443 JP (Japan): 34.95.66.187:443 SG (Singapore): 34.120.142.18:443 AU (Australia): 34.102.237.151:443 DE (Germany): 34.107.161.143:443 IN (India): 34.120.213.187:443 DL (Delhi): 136.110.132.208:443 CH (Switzerland): 34.149.180.250:443 PL (Poland): 35.190.13.237:443 TW (Taiwan): 34.149.248.76:443 QT (Qatar): 34.107.129.254:443 FA (France): 34.36.155.211:443 IL (Israel): 34.128.157.130:443 SA (Saudi Arabia): 34.107.213.85:443 ID (Indonesia): 34.128.156.84:443 ES (Spain): 34.120.102.147:443 IT (Italy): 34.8.234.58:443 KR (South Korea): 34.54.155.245:443 ZA (South Africa): 35.190.79.68:443 BR (Brazil): 136.110.146.246:443 FI (Finland): 136.110.165.34:443	`traps-management-service`
`ch-``<tenant-name>``.traps.paloaltonetworks.com` Used for all other requests between the agent and its tenant server, including heartbeat, uploads, action results, and scan reports.	IP address by region: US (United States): 34.98.77.231:443 EU (Europe): 34.102.140.103:443 CA (Canada): 34.96.120.25:443 UK (United Kingdom): 35.244.133.254:443 JP (Japan): 34.95.66.187:443 SG (Singapore): 34.120.142.18:443 AU (Australia): 34.102.237.151:443 DE (Germany): 34.107.161.143:443 IN (India): 34.120.213.188:443 DL (Delhi): 136.110.132.208:443 CH (Switzerland): 34.149.180.250:443 PL (Poland): 35.190.13.237:443 TW (Taiwan): 34.149.248.76:443 QT (Qatar): 34.107.129.254:443 FA (France): 34.36.155.211:443 IL (Israel): 34.128.157.130:443 SA (Saudi Arabia): 34.107.213.85:443 ID (Indonesia): 34.128.156.84:443 ES (Spain): 34.120.102.147:443 IT (Italy): 34.8.234.58:443 KR (South Korea): 34.54.155.245:443 ZA (South Africa): 35.190.79.68:443 BR (Brazil): 136.110.146.246:443 FI (Finland): 136.110.165.34:443	`traps-management-service`
`api-``<tenant-name>.xdr.<region>``.paloaltonetworks.com` Used for API requests and responses and to connect to an engine.	IP address by region: US (United States): 35.222.81.194:443 EU (Europe): 34.90.67.58:443 CA (Canada): 35.203.82.121:443 UK (United Kingdom): 34.89.56.78:443 JP (Japan): 34.84.125.129:443 SG (Singapore): 34.87.83.144:443 AU (Australia): 35.189.18.208:443 DE (Germany): 34.107.57.23:443 IN (India): 35.200.158.164:443 DL (Delhi): 34.131.165.103:443 CH (Switzerland): 34.65.248.119:443 PL (Poland): 34.116.216.55:443 TW (Taiwan): 35.234.8.249:443 QT (Qatar): 34.18.46.240:443 FA (France): 34.155.222.152:443 IL (Israel): 34.165.156.139:443 SA (Saudi Arabia): 34.166.58.79:443 ID (Indonesia): 34.128.115.238:443 ES (Spain): 34.175.30.176:443 IT (Italy): 34.154.195.120:443 KR (South Korea): 34.64.54.175:443 ZA (South Africa): 34.35.64.191:443 BR (Brazil): 34.39.136.78:443 FI (Finland): 35.228.73.215:443	—
`cc-``<tenant-name>``.traps.paloaltonetworks.com` Used for get-verdict requests. For agents on endpoints, you must allow the IP address for the closest region to ensure connectivity. Endpoints use latency-based routing. An agent that belongs to a US tenant, for example, but that is physically located in Singapore, routes to Singapore to get the verdict.	IP address by region: US (United States): 35.224.140.142:443 EU (Europe): 34.90.71.103:443 CA (Canada): 35.203.35.23:443 UK (United Kingdom): 34.89.42.214:443 JP (Japan): 34.84.225.105:443 SG (Singapore): 35.247.161.94:443 AU (Australia): 35.201.23.188:443 DE (Germany): 35.242.201.199:443 IN (India): 35.244.57.196:443 DL (Delhi): 34.131.47.126:443 CH (Switzerland): 34.65.137.215:443 PL (Poland): 34.116.213.71:443 TW (Taiwan): 35.229.186.216:443 QT (Qatar): 34.18.53.229:443 FA (France): 34.155.110.169:443 IL (Israel): 34.165.2.110:443 SA (Saudi Arabia): 34.166.53.160:443 ID (Indonesia): 34.101.155.198:443 ES (Spain): 34.175.205.166:443 IT (Italy): 34.154.230.76:443 KR (South Korea): 34.64.228.117:443 ZA (South Africa): 34.35.13.198:443 BR (Brazil): 34.39.195.104:443 FI (Finland): 35.228.118.177:443	`traps-management-service`
`xdr-<region>-<project ID>-tim-indicators.storage.googleapis.com` Used to download the IOC indicators from the tenant.	IP address by region: US (United States): 35.224.140.142:443 EU (Europe): 34.90.71.103:443 CA (Canada): 35.203.35.23:443 UK (United Kingdom): 34.89.42.214:443 JP (Japan): 34.84.225.105:443 SG (Singapore): 35.247.161.94:443 AU (Australia): 35.201.23.188:443 DE (Germany): 35.242.201.199:443 IN (India): 35.244.57.196:443 DL (Delhi): 34.131.47.126:443 CH (Switzerland): 34.65.137.215:443 PL (Poland): 34.116.213.71:443 TW (Taiwan): 35.229.186.216:443 QT (Qatar): 34.18.53.229:443 FA (France): 34.155.110.169:443 IL (Israel): 34.165.2.110:443 SA (Saudi Arabia): 34.166.53.160:443 ID (Indonesia): 34.101.155.198:443 ES (Spain): 34.175.205.166:443 IT (Italy): 34.154.230.76:443 KR (South Korea): 34.64.228.117:443 ZA (South Africa): 34.35.13.198:443 BR (Brazil): 34.39.195.104:443 FI (Finland): 35.228.118.177:443	`cortex-xdr`
Broker VM Resources Required for deployments that use Broker VM features
xdr-ova-installers-prod-us.storage.googleapis.com Used to download Broker VM images from the server. This storage bucket is used for all regions.	IP ranges in GCP Port: 443	`cortex-xdr`
`br-``<tenant-name>.xdr.<region>``.paloaltonetworks.com`	IP address by region: US (United States): 104.155.131.72:443 EU (Europe): 34.91.128.226:443 CA (Canada): 34.95.8.232:443 UK (United Kingdom): 35.197.219.110:443 JP (Japan):34.85.74.43:443 SG (Singapore): 34.87.167.125:443 AU (Australia): 35.244.93.0:443 DE (Germany): 35.198.112.13:443 IN (India): 35.200.234.99:443 DL (Delhi): 34.131.131.141:443 CH (Switzerland): 34.65.51.103:443 PL (Poland): 34.116.176.97:443 TW (Taiwan): 34.80.230.166:443 QT (Qatar): 34.18.37.73:443 FA (France): 34.155.90.61:443 IL (Israel): 34.165.24.222:443 SA (Saudi Arabia): 34.166.55.153:443 ID (Indonesia): 34.101.101.170:443 ES (Spain): 34.175.182.55:443 IT (Italy): 34.154.168.139:443 KR (South Korea): 34.64.46.249:443 ZA (South Africa): 34.35.45.251:443 BR (Brazil): 35.198.38.182:443 FI (Finland): 34.88.26.246:443	—
`distributions.traps.paloaltonetworks.com`	IP address: 35.223.6.69 Port: 443	`traps-management-service`
`time.google.com` `pool.ntp.org`	UDP port: 123	—
App Login and Authentication
identity.paloaltonetworks.com (SSO)	IP address: 34.120.119.85 Port: 443	—
login.paloaltonetworks.com (SSO)	IP address: 34.102.139.110 Port: 443	—
In-App Help Center and Notifications
data.pendo.io	Port: 443	—
pendo-static-5664029141630976.storage.googleapis.com	Port: 443	—
Email Notifications
—	IP address for all regions: 159.183.150.248	—
Ingress These IPs are used for communication between Cortex XSIAM and your resources. Use them when sending data out from your tenant.
	FI (Finland): 34.88.97.182 34.88.189.1 US (United States) 34.132.108.184 34.69.63.16 EU (Europe) 34.147.107.51 34.91.26.125 CA (Canada) 35.203.108.13 35.203.101.162 UK (United Kingdom) 35.242.180.163 34.105.173.229 JP (Japan) 35.200.3.131 34.146.181.233 SG (Singapore) 35.240.243.57 34.126.183.208 AU (Australia) 34.151.83.236 34.116.67.90 DE (Germany) 35.234.118.195 34.89.183.45 IN (India) 35.200.175.78 34.93.9.198 CH (Switzerland) 34.65.108.153 34.65.155.169 PL (Poland) 34.118.48.171 34.116.202.235 TW (Taiwan) 34.80.133.68 35.234.18.10 QT (Qatar) 34.18.34.118 34.18.39.155 FA (France) 34.155.5.117 34.155.41.247 IL (Israel) 34.165.33.165 34.165.27.131 SA (Saudi Arabia) 34.166.61.81 34.166.58.213 ID (Indonesia) 34.128.126.138 34.128.82.158 ES (Spain) 34.175.46.46 34.175.80.182 IT (Italy) 34.154.23.156 34.154.186.12 KR (South Korea) 34.64.93.168 34.64.237.45 ZA (South Africa): 34.35.42.196 34.35.79.219	`cortex-xdr`
Egress IP addresses Used for traffic from the Cortex tenant to external services and systems. Add the relevant IP addresses from this list to your allow lists for your external services and systems.
	IP addresses by region FI (Finland) 35.228.175.228 35.228.44.44 US (United States) 35.225.156.101 34.69.88.119 EU (Europe) 34.147.67.188 34.90.16.31 CA (Canada) 35.203.57.162 35.203.90.79 UK (United Kingdom) 34.142.3.42 34.142.44.136 JP (Japan) 34.146.60.215 34.84.93.160 SG (Singapore) 35.240.144.192 35.240.255.15 AU (Australia) 35.244.73.76 35.201.22.63 DE (Germany) 34.107.83.197 34.159.53.97 IN (India) 35.244.5.205 34.93.118.113 DL (Delhi) 34.131.207.151 34.126.212.40 CH (Switzerland) 34.65.222.25 34.65.233.60 PL (Poland) 34.118.92.214 34.116.223.119 TW (Taiwan) 104.199.223.229 34.81.38.132 QT (Qatar) 34.18.39.0 34.18.32.96 FA (France) 34.155.197.131 34.155.5.100 IL (Israel) 34.165.46.47 34.165.17.246 SA (Saudi Arabia) 34.166.58.243 34.166.54.238 ID (Indonesia) 34.101.125.66 34.101.218.184 ES (Spain) 34.175.255.99 34.175.230.35 IT (Italy) 34.154.173.134 34.154.229.60 KR (South Korea) 34.64.189.205 34.64.45.118 ZA (South Africa) 34.35.70.193 34.35.80.189 BR (Brazil) 35.199.96.109 34.39.161.254	—
Collect third-party data from your SaaS and Cloud resources
—	IP address by region. FI (Finland) 35.228.192.167 34.88.193.126 US (United States) 34.66.69.154 35.202.21.123 AU (Australia) 35.197.181.108 35.197.175.44 CA (Canada) 34.95.33.72 34.95.62.136 SG (Singapore) 35.247.148.38 35.247.173.40 JP (Japan) 34.85.68.167 34.84.99.239 IN (India) 34.93.3.196 34.93.175.218 DL (Delhi) 34.131.111.87 34.131.101.138 DE (Germany) 34.89.197.46 34.107.3.224 UK (United Kingdom) 34.105.227.146 34.105.137.22 EU (Europe) 34.90.70.107 35.204.129.196 CH (Switzerland) 34.65.225.124 34.65.89.6 PL (Poland) 34.118.71.237 34.118.124.130 TW (Taiwan) 35.201.142.86 35.189.176.163 QT (Qatar) 34.18.44.71 34.18.30.132 FA (France) 34.163.125.167 34.163.155.105 IL (Israel) 34.165.131.171 34.165.120.206 SA (Saudi Arabia) 34.166.59.20 34.166.53.242 ID (Indonesia) 34.101.158.32 34.101.79.159 ES (Spain) 34.175.27.251 34.175.198.50 IT (Italy) 34.154.208.247 34.154.243.11 KR (South Korea) 34.64.107.163 34.64.84.25 ZA (South Africa): 34.35.69.156 34.35.60.86 BR (Brazil) 34.39.177.125 34.39.140.36	`cortex-xdr`
Log Forwarding to a Syslog Receiver
See Integrate a syslog receiver.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam/enable-access-to-required-panw-resources.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.