Create and Associate a Deployment Profile for Prisma AIRS AI Runtime: Network Intercept

Table of Contents

Prisma AIRS AI Runtime: Network Intercept Prerequisites and Limitations

Onboard and Activate a Cloud Account in Strata Cloud Manager

Create and Associate a Deployment Profile for Prisma AIRS AI Runtime: Network Intercept

Create Prisma AIRS AI Runtime: Network intercept deployment profile in the Palo Alto Networks customer support portal and associate it with a tenant service group.

Where Can I Use This?	What Do I Need?
Prisma AIRS AI Runtime Security	Prisma AIRS Licenses Activate Strata Logging Service

To deploy Prisma AIRS AI Runtime: Network intercept, create a deployment profile in the Palo Alto Networks Customer Support Portal and associate it with a Tenant Service Group (TSG). The deployment profile defines how many vCPUs and instances you plan to use, and allows the system to allocate credits appropriately.

Licensing Capacity Limit: Limited to processing up to 10K AI transactions per day per vCPU of Prisma AIRS AI Runtime: Network intercept.

Log in to the Palo Alto Networks Customer Support Portal.
Select Products Software/Cloud NGFW Credits.
Locate your credit pool and click Create Deployment Profile. This lets you define how credits will be allocated for Prisma AIRS instances.
Select AI Runtime Security (Instance) and click Next.
Select PAN-OS 11.2.2 and above and click Next.

PAN-OS is required for managing deployment compatibility and service integration.
Enter the Prisma AIRS details:
1. Deployment Profile Name.
2. Number of Prisma AIRS instances.
3. Planned vCPU per instances.
Review the Prisma AIRS AI Runtime: Network intercept Setup Prerequisites and Limitations to validate your configuration.
Optional Panorama for Management (with Log Collector) to create a deployment profile for Panorama maanged firewall.
Select Create Deployment Profile.

The subscriptions and services used by Prisma AIRS AI Runtime: Network intercept are bundled and pre-configured. That is why, you cannot customize or modify them as part of this deployment.

You’ve now created and associated a deployment profile for Prisma AIRS AI Runtime: Network intercept. This enables you to allocate resources and begin securing AI network traffic across your selected tenant environment.

Associate a Deployment Profile with a TSG

After creating a deployment profile for Prisma AIRS, the next step is to associate it with a Tenant Service Group (TSG). This association links your deployment to a specific tenant environment and is required to activate thePrisma AIRS services.

You must complete this step before onboarding cloud accounts or using runtime services.

Log in to Palo Alto Networks Customer Support Portal.
Select Products Software/Cloud NGFW Credits.
Locate the credit pool you used to create the deployment profile and click Details.
Locate the Prisma AIRS AI Runtime: Network intercept deployment profile and click Finish Setup.
In the Activate Subscriptions based on Deployment Profile(s) form, select the following:
Select the Customer Support Account used to create your deployment profile from the available list.
Select Tenant.

Verify that the Strata Logging Service is enabled for this tenant.
Select a Region.
In Select Deployment Profile, select the deployment profile you created previously.
Click Done.

Keep existing deployment profiles checked to maintain their association with the tenant.
Enable Cloud Identity Engine or create a new one for centralized, cloud-based user identity management and enhanced security policy enforcement across your entire Palo Alto Networks deployment.
Agree to the Terms and Conditions.
Click Activate and record the Auth Code.
Verify that the TSG association succeeded by logging into the Hub, selecting Common Services → Tenant Management, and selecting your tenant.

The initial association between the deployment profile and TSG may take up to 30 minutes.

Make sure your Strata Logging Service license is active. If it has expired, renew it before onboarding a cloud account to avoid issues with onboarding or Terraform generation.