Palo Alto Networks BYOIP Integration Overview
Location
This page outlines the technical and procedural information required for integrating Bring Your Own IP (BYOIP) with Palo Alto Networks cloud-delivered security services—primarily Cloud NGFW for AWS using Egress NAT with Bring Your Own IPs (BYOIPs). In this model, you first onboard your public IPv4/IPv6 space into AWS BYOIP, then (for Cloud NGFW egress) you provision and advertise the CIDR through AWS IP Address Manager (IPAM) and share an IPAM pool so Palo Alto Networks’ Cloud NGFW dataplane can use your addresses for source NAT egress. Palo Alto Networks also exposes a “Bring Your Own IP” option for Prisma Access Service Provider Interconnect (SPI) IP pools, allowing BYOIP-based Ingress and Egress IP Pools in supported SPI regions.
Provider Details
| Field | Information |
|---|---|
| Provider Name | Palo Alto Networks |
| Legal Name | Palo Alto Networks, Inc. |
| Category | Other (Security / SASE / Managed Firewall Services) |
| Website | Cloud NGFW for AWS: Configure Egress NAT (BYOIPs) | Prisma Access SPI: Add IP Pool (Bring Your Own IP) | Prisma Access SPI: Supported Regions / Locations | AWS EC2 BYOIP Overview (upstream requirement) |
| BYOIP-Related Product(s) |
Cloud NGFW for AWS: Egress NAT with Bring Your Own IPs (BYOIPs) via AWS IPAM pool sharing. Prisma Access (SPI): “Bring Your Own IP” option for Ingress and Egress IP Pool configuration in Service Provider Interconnects. |
| ASN(s) |
Cloud NGFW for AWS BYOIP advertisement is performed via AWS (you select an appropriate ASN when advertising the CIDR in AWS). Palo Alto Networks does not document originating your prefix from a Palo Alto Networks ASN for this flow. Prisma Access SPI: uses your public/private BGP ASN for peering to exchange routes (interconnect connectivity), separate from BYOIP address ownership. |
| Regions Supported |
Cloud NGFW for AWS BYOIPs inherit AWS BYOIP regional availability (AWS BYOIP is available in all commercial AWS Regions except China Regions). Prisma Access SPI supports a defined set of regions/locations depending on cloud provider (AWS or GCP). Representative AWS SPI locations include: US East/West/Central, UK, Ireland, Germany (Central), France (North), Sweden, Singapore, Japan (Central), UAE (see full supported list in the SPI locations reference). |
| Support Contact | Palo Alto Networks Support Portal | Knowledge Base | Contact / Sales |
| Tech Article & Date |
Cloud NGFW for AWS: Configure Egress NAT (Updated Jan 20, 2026). Prisma Access SPI: Add IP Pool & SPI Locations (Updated Jan 27, 2026). |
| BYOIP Scope |
Cloud NGFW for AWS: customer-owned public IP space is onboarded to AWS (BYOIP), then provisioned/advertised in an AWS IPAM pool; the pool is shared so Cloud NGFW can use the resulting public IPs for Egress NAT (source NAT). Prisma Access SPI: BYOIP option configures Ingress/Egress IP Pools for interconnect deployments (use-case: controlling published ingress/egress IPs per SPI deployment). |
| Supported Versions |
Cloud NGFW for AWS BYOIPs: IPAM pool must be created with Address Family = IPv4 (IPv4 egress NAT public IPs). Upstream AWS BYOIP supports IPv4 and IPv6, but this Cloud NGFW BYOIP egress flow is documented as IPv4-based. Prisma Access SPI: interconnect configuration supports IPv4 single-stack or IPv4+IPv6 dual-stack for some cloud provider configurations; BYOIP IP pool address-family specifics are not exhaustively documented on the “Add IP Pool” page. |
| Supported Services |
Cloud NGFW for AWS (Egress NAT with BYOIPs supported for rulestack and Panorama policy management). Prisma Access (Managed by Strata Cloud Manager) for Service Provider Interconnects (Bring Your Own IP for IP Pools). |
| BYOIP Automation Level | Semi-automatic: you complete AWS IPAM/BYOIP onboarding and pool sharing steps, then Cloud NGFW consumes the shared pool for egress NAT. Releasing addresses back to your pool is documented as a support-assisted action. |
Technical Requirements
| Requirement | Details |
|---|---|
| BYOIP Prerequisite Platform | AWS BYOIP is the upstream mechanism for bringing publicly routable IPv4/IPv6 space to AWS and advertising it through AWS (the BYOIP range appears as an address pool in your AWS account). |
| Prefix Size | Upstream AWS BYOIP: smallest publicly routable IPv4 range is /24; IPv6 BYOIP supports /48 (publicly advertisable) and /60 for some non-public cases. Cloud NGFW’s Egress NAT BYOIP flow is documented using an AWS IPAM pool with Address Family = IPv4. |
| ASN Ownership Required |
Cloud NGFW for AWS BYOIPs: no customer ASN is required for Cloud NGFW to perform egress NAT; your CIDR is advertised via AWS and you select an appropriate ASN when advertising the CIDR in AWS. Prisma Access SPI: you provide a public or private BGP ASN for peering (route exchange) during interconnect setup. |
| ROA or LOA |
ROA: in AWS BYOIP, ROAs are referenced as part of the ecosystem and are not required only for certain non-publicly advertisable cases; for publicly advertised space, plan on maintaining the required RPKI/registry objects per AWS guidance. LOA: not described in the Palo Alto Networks Cloud NGFW BYOIP flow; ownership is handled through AWS BYOIP control validation. |
| Ownership Validation | AWS validates that you control the IP range using either: (1) RDAP + X.509 certificate validation, or (2) DNS TXT validation via IPAM-based onboarding. In the Cloud NGFW BYOIP flow, you provision a CIDR to an IPAM pool using X.509 certificate input (signature-based workflow). |
| IRR / Route Objects | AWS BYOIP documentation states AWS automatically updates RADb for BYOIP; manual IRR changes that include the BYOIP ASN can cause provisioning failures. |
| AWS IPAM Pool | For Cloud NGFW BYOIPs, you must create an AWS IPAM pool, provision/advertise the CIDR, then share the pool with the Cloud NGFW deployment account. The pool locale should match where you deploy Cloud NGFW. |
| Cloud NGFW Dataplane Account Allowlist | When creating the IPAM pool for BYOIPs, you must whitelist the Cloud NGFW dataplane AWS account ID: 010510656586. |
Step-by-Step BYOIP Process
Estimated Setup Time: Creating the required AWS IPAM pool may take ~10 minutes. End-to-end timelines vary based on AWS BYOIP onboarding/registry validation and propagation once advertisement is enabled.
Tested By Us: Not yet
A) Prepare and advertise your BYOIP range in AWS (IPAM + BYOIP prerequisite)
B) Enable Cloud NGFW for AWS Egress NAT and attach your BYOIPs (IPAM Pool ID)
C) Releasing BYOIP addresses back to your IPAM pool (support-assisted)
D) (Optional) Prisma Access Service Provider Interconnect (SPI): enable “Bring Your Own IP” for IP Pools
References: Cloud NGFW for AWS: Configure Egress NAT, AWS EC2 BYOIP, AWS VPC IPAM Overview, Prisma Access SPI: Add IP Pool, Prisma Access SPI: Locations.
Cost and Limitations
| Item | Details |
|---|---|
| Fees | With Cloud NGFW Egress NAT, you avoid AWS NAT Gateway costs; Palo Alto Networks documents that you pay Palo Alto Networks for egress traffic data transfer. If you use Palo Alto Networks-managed AWS Elastic IPs instead of BYOIPs, you incur hourly EIP management costs. Using BYOIPs is positioned to avoid hourly EIP management costs. |
| Bundled or Standalone | BYOIPs are not a standalone SKU; they are part of the Egress NAT configuration path for Cloud NGFW for AWS (requires Cloud NGFW subscription and AWS account). Prisma Access SPI “Bring Your Own IP” is part of SPI IP Pool configuration. |
| Operational Limitations |
Egress NAT policy management constraint: Egress NAT with BYOIPs is supported for rulestack and Panorama policy management (not documented for all management modes). IP pool lifecycle constraint: When adding new CIDRs for Egress NAT, do not add them to an existing IP pool already in use by a Cloud NGFW resource; create a new IP pool and associate it with the firewall. Regional constraint (AWS BYOIP): you bring each address range to one AWS Region at a time and AWS enforces per-region quotas. |
| Release / Rollback | Releasing BYOIP addresses back to your AWS IPAM pool is documented as a support-assisted operation (open a support case). |
Automation & Developer Access
Abuse & Reputation Management
Related Resources
Palo Alto Networks Homepage
Cloud NGFW for AWS: Configure Egress NAT (BYOIPs)
Support Portal
AWS EC2 BYOIP
AWS VPC IPAM Overview
Prisma Access SPI: Add IP Pool
Prisma Access SPI: Supported Regions / Locations