Relay
Network and certificate requirements
Check connectivity from the Relay before troubleshooting credentials.
On this page
Required connection paths
| Connection | Typical destination | Purpose |
|---|---|---|
| Relay to ConfigProof | HTTPS, TCP 443 to configproof.com | Token preflight, delivery and result access. |
| Relay to device API | HTTPS management port, commonly TCP 443 | Platform identity and configuration reads. |
| Relay to SSH device | TCP 22 unless configured otherwise | Authorized configuration and operational reads. |
| Relay to SCM authentication/API | auth.apps.paloaltonetworks.com and api.strata.paloaltonetworks.com over HTTPS | Service-account authentication and SCM configuration. |
| Relay to other cloud manager | Vendor regional endpoint over HTTPS | Tenant / organization collection. |
| Relay to ISE ERS | TCP 443 or legacy TCP 9060 as selected | ERS data; OpenAPI availability is separate. |
Test reachability
Test from the Relay workstation. An open port does not prove that credentials or API permissions work.
Certificates and host identity
Prefer valid management certificates. If a pinned certificate or SSH host key changes, verify the device with its owner before updating trust. Keep unrelated trusted hosts intact.
VPN, jumpboxes and source restrictions
- Connect to the approved VPN or jumpbox.
- Allow the Relay source in vendor Trusted Hosts, API client lists and firewall policies.
- Confirm unexpected certificates with the network owner, including changes caused by TLS inspection.