Prisma Access Locations IP Addresses

[jeppich]

I'm struggling to find the IP Addresses allocated for the 5 Prisma Access Locations we're using.  We would like to build a conditional access policy in M365 to only allow traffic from our Global Protect client via the Gateway IP addresses or ranges.  I've seen articles saying to use the API which I have zero knowledge of.  I just want the IPs so I can begin building and testing our policy.

Is this information available in the Prisma UI?

[abhinav2308]

Hello Jeppich,

Greetings of the day!

The only way to get the Prisma gateway IP address is using API , you can fetch with that
https://docs.paloaltonetworks.com/prisma/prisma-access/3-1/prisma-access-panorama-admin/prisma-acces...
Or you can open a TAC case with the Prisma team, requesting them to share the IP, Maybe they might share
Additionally you can try to fetch the IP, I can help you with that,

just post here.

[jeppich]

I've read that article many times.  We don't use Panorama so I don't understand how I can run the API Script.

I was able to find the GP locations IP Addresses in the console.  Not exactly the easiest to find.  However, my new issue is we've begun routing internet traffic in one of our Remote Networks via Policy Based Forwarding through the IPSec tunnel to Prisma.  The egress IP for the users in that office is now different and not part of the GP Locations addresses (obviously, since it's not GP).  The service endpoint address for the RN is not the egress IP.  The only way I've read is to run the API Script which Palo Alto doesn't document very well if you're not using Panorama.

[Vickynet]

Hello @jeppich , I believe there is similar documentation for Cloud-Managed Prisma Access. You can reference this https://docs.paloaltonetworks.com/prisma-access/administration/prisma-access-setup/retrieve-ip-addre... and just focus on the Strata Cloud Manager Tab. Within that tab, under the Legacy Scripts Used to Retrieve IP and Loopback Addresses, you should be able to retrieve the commands used in Mobile User Deployments or Remote Network deployment. 

I hope you find this helpful. 

Thank you,

Vickynet