Enable access to required PANW resources Cortex

KVishwan — Mon, 23 Mar 2026 18:03:49 GMT

I would like to deploy an XDR

For IP address ranges in Google Cloud Platform (GCP), refer to these lists for IP address coverage for your deployment:

https://www.gstatic.com/ipranges/goog.json: IP address subnet ranges
https://www.gstatic.com/ipranges/cloud.json: IP address ranges associated with your region

Should I use all the IP address range in the region for example if I choose to use US Central region.

Should I include all the IP ranges data centers in US Central region for example : us-central1, us-central2, us-central3 all that belongs to us-central

or just us-central1 should be fine ?

Regards,

Vishwanath

Re: Enable access to required PANW resources Cortex

susekar — Mon, 23 Mar 2026 18:25:45 GMT

Hello @KVishwan ,

Greetings for the day.

When deploying Cortex XDR, the preferred firewall configuration method is to allow traffic using FQDNs or Palo Alto Networks App-IDs rather than static IP addresses. This is because cloud IPs (especially in GCP) are dynamic and frequently change, making IP-based rules harder to maintain.

(If IP-Based Whitelisting Is Required)

If your environment strictly requires IP allowlisting, follow these best practices:

Use GCP IP Range Files

goog.json
Contains global IP ranges for all Google services.
Use this to ensure full coverage of shared/global infrastructure.
cloud.json
Contains region-specific IP ranges.
Useful if you want a more restrictive, region-focused policy.

Regional Coverage (e.g., US Central):

If your Cortex XDR tenant is hosted in a region like US Central, you should:

Allow All Regional Ranges

Include all relevant sub-regions such as:
- us-central1
- us-central2
- us-central3 (and any future expansions)

Why This Matters:

High Availability:
Traffic may shift between sub-regions due to load balancing or backend changes
Redundancy:
Limiting access to only one sub-region (e.g., us-central1) can cause disruptions
Platform Updates:
Services like agent updates or content delivery may originate from different ranges

Operational Risk of Restriction

Restricting firewall rules too tightly (e.g., to a single IP range or sub-region) can lead to:

Failed agent communication
Content update issues
Installation or upgrade failures

Best practice is to allow all documented GCP ranges relevant to Cortex XDR.

Key Requirements Summary:

Protocol/Port:
Allow outbound TCP 443 (HTTPS)
Global Services (Examples):
- panw-xdr-installers-prod-us.storage.googleapis.com → agent installation/updates
- global-content-profiles-policy.storage.googleapis.com → content updates
Data Locality:
Even if IPs appear geolocated elsewhere, your customer data remains within your deployment region.

Enable access to required PANW resources:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/Enable-access-to-required-PANW-resources

If this resolves your query, please consider marking the response as a solution and clicking "Like."

Thanks & Regards,
S. Subashkar Sekar

topic Re: Enable access to required PANW resources Cortex in Cortex XDR Discussions