topic XDR Resource IPs for Connectivity to XDR Server in Cortex XDR Discussions

XDR Resource IPs for Connectivity to XDR Server

SeanDeHarris — Mon, 18 Sep 2023 07:00:15 GMT

Dear experts,

From the following resource table, two json tables for GCP are provided (one for Google subnet and another for Google IP range associated with my region)

Question:

For the connectivity, do we need to allow all GCP IP range (in the json file) or just those IP ranges associated with my region chosen (my Tenants)?

Is there an easier way to import the json file to my firewall and create the network object???

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Resources-Required-to-Enable-Access

Your comments will be appreciated.

Many thanks.

Re: XDR Resource IPs for Connectivity to XDR Server

nsinghvirk — Tue, 19 Sep 2023 09:38:25 GMT

Hello @SeanDeHarris

Thanks for reaching out on Live Community!

If you are using Palo Alto NGFW then easiest way will be to add the App-ids. For the 3rd party firewalls you can use the given FQDNs along with the ports.

However if you want to use IP address then you need to allow all the IPs mentioned in both json files. This is required for redundancy because GCP can failover to other region in case they are facing any issue in one of the region.

In Palo Alto NGFW firewalls, there is option to import JSON files. For 3rd party firewalls, you can do the conversion to import in appropriate format.