Enable access to required PANW resources Cortex

[KVishwan]

I would like to deploy an XDR

For IP address ranges in Google Cloud Platform (GCP), refer to these lists for IP address coverage for your deployment:

• https://www.gstatic.com/ipranges/goog.json: IP address subnet ranges

• https://www.gstatic.com/ipranges/cloud.json: IP address ranges associated with your region

Should I use all the IP address range in the region for example if I choose to use US Central region. 

Should I include all  the IP ranges data centers in US Central region for example :  us-central1, us-central2, us-central3  all that belongs to us-central

or just us-central1 should be fine ?

Regards,

Vishwanath

[susekar]

Hello @KVishwan ,

Greetings for the day.

When deploying Cortex XDR, the preferred firewall configuration method is to allow traffic using FQDNs or Palo Alto Networks App-IDs rather than static IP addresses. This is because cloud IPs (especially in GCP) are dynamic and frequently change, making IP-based rules harder to maintain.

(If IP-Based Whitelisting Is Required)

If your environment strictly requires IP allowlisting, follow these best practices:

Use GCP IP Range Files

• goog.json
  Contains global IP ranges for all Google services.
  Use this to ensure full coverage of shared/global infrastructure.
• cloud.json
  Contains region-specific IP ranges.
  Useful if you want a more restrictive, region-focused policy.

 

Regional Coverage (e.g., US Central):

If your Cortex XDR tenant is hosted in a region like US Central, you should:

Allow All Regional Ranges

• Include all relevant sub-regions such as:
  • us-central1
  • us-central2
  • us-central3 (and any future expansions)

Why This Matters:

• High Availability:
  Traffic may shift between sub-regions due to load balancing or backend changes
• Redundancy:
  Limiting access to only one sub-region (e.g., us-central1) can cause disruptions
• Platform Updates:
  Services like agent updates or content delivery may originate from different ranges

 

Operational Risk of Restriction

Restricting firewall rules too tightly (e.g., to a single IP range or sub-region) can lead to:

• Failed agent communication
• Content update issues
• Installation or upgrade failures

Best practice is to allow all documented GCP ranges relevant to Cortex XDR.

 

Key Requirements Summary:

• Protocol/Port:
  Allow outbound TCP 443 (HTTPS)
• Global Services (Examples):
  • panw-xdr-installers-prod-us.storage.googleapis.com → agent installation/updates
  • global-content-profiles-policy.storage.googleapis.com → content updates
• Data Locality:
  Even if IPs appear geolocated elsewhere, your customer data remains within your deployment region.

Enable access to required PANW resources:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/Enable-access-to-...

If this resolves your query, please consider marking the response as a solution and clicking "Like."

Thanks & Regards,
S. Subashkar Sekar