Prisma Cloud Defenders need the Prisma NAT gateway IPs allowlisted or they cannot reach the Console

TL;DR

Before deploying Defenders, pull the Prisma Cloud NAT gateway IP list from the docs and add it to your egress allow lists, and make sure port 443 outbound to the Console is open. If egress goes through an authenticating proxy, configure the HTTP proxy in Prisma Cloud per the proxy docs instead of expecting direct egress. If Defenders deploy but show as disconnected or never check in, check the firewall/NAT rules first, not the Defender config.

The error

Prisma Cloud Defenders need the Prisma NAT gateway IPs allowlisted or they cannot reach the Console

Fix

1. Before deploying Defenders, pull the Prisma Cloud NAT gateway IP list from the docs and add it to your egress allow lists, and make sure port 443 outbound to the Console is open. Expected: You get the expected result; the problem is gone.

2. If egress goes through an authenticating proxy, configure the HTTP proxy in Prisma Cloud per the proxy docs instead of expecting direct egress. Expected: You get the expected result; the problem is gone.

3. Re-run the original operation and confirm the error is gone. Expected: no error, normal output.

When to use

• You hit this exact error.
• The symptom matches: Prisma Cloud Defenders need the Prisma NAT gateway IPs allowlisted or they cannot reach the Console.

When NOT to use

• A different error message; the cause here is specific to this error.
• Unrelated issues with a different cause.
• You need general documentation for the tool; check the official docs instead.

Compatibility

Reported per the linked source.

Variant phrasings

Prisma Cloud Defenders need the Prisma NAT gateway IPs allowlisted or they cannot reach the Console

Why it happens

Community thread on live.paloaltonetworks.com: users setting up Prisma Cloud for ACR/AKS hit Defender connectivity failures. The verified answer: Prisma Cloud uses NAT gateway IP addresses, and Defenders must be able to reach the Prisma Cloud Compute Console; if those IPs are not in your allow lists, Defenders silently fail to communicate. In the SaaS Enterprise Edition the Defender websocket connects to Console on port 443 (not configurable).

Edge cases

• If your error message differs even slightly, this is probably a different issue; search the exact text.
• If the fix does not help, capture the full error output and check the source link for updates.

Source: Community thread on live.paloaltonetworks.com: users setting up Prisma Cloud for ACR/AKS hit Defender connectivity failures. The verified answer: Prisma Cloud uses NAT gateway IP addresses, and Defenders must be able to reach the Prisma Cloud Compute Console; if those IPs are not in your allow lists, Defenders silently fail to communicate. In the SaaS Enterprise Edition the Defender websocket connects to Console on port 443 (not configurable).

Verified resolution: Before deploying Defenders, pull the Prisma Cloud NAT gateway IP list from the docs and add it to your egress allow lists, and make sure port 443 outbound to the Console is open. If Defenders deploy but show as disconnected or never check in, check the firewall/NAT rules first, not the Defender config. If egress goes through an authenticating proxy, configure the HTTP proxy in Prisma Cloud per the proxy docs instead of expecting direct egress.

Source URL: https://live.paloaltonetworks.com/t5/prisma-cloud-discussions/instructions-and-best-practices-guide-for-setting-up-prisma/m-p/574862/highlight/true