Focus

Prisma AIRS

Networks Channels Management

Table of Contents

Networks Channels Management

Procedure to create and manage network channels.

Where Can I Use This?	What Do I Need?
Prisma AIRS (AI Red Teaming)	Prisma AIRS AI Red Teaming License Prisma AIRS AI Red Teaming Deployment Profile

A channel is a unique communication pathway that clients use to establish connections. Each channel has a unique connection URL with authentication credentials. You will need to create and validate a channel first, before using it to add a target. Multiple channels can be created for different environments and each channel can handle multiple targets accessible to it.

All the clients connected to the same channel are treated as homogenous. For channels with multiple clients connected, the requests will be routed through any of the clients using a round robin algorithm. This helps achieve a highly available client deployment.

The status of the channel can be one of the following:

Channel Status	Description
Draft	The channel has not connected to any client yet.
Online	The channel is online, connected to a client and can be used to connect to the target.
Offline	The channel is offline, meaning it is not connected to any client.

Create Channel

Before creating a Network Channel, select the deployment method that matches your infrastructure and ensure the required tools are installed and configured.

The Docker Compose and Standalone Binary deployment methods support Linux amd64 and arm64 architectures. These architectures do not apply to Kubernetes (Helm) deployments.

Deployment Method	Requirement	Details
Kubernetes (Helm) The Network Channel client is configured with CPU and memory requests of 100m and 128Mi, respectively, while the resource limits are capped at 200m CPU and 256Mi memory.	Kubernetes cluster	A running environment (local like Minikube/Kind, or cloud-based).
	Kubectl	The command-line tool configured to communicate with your cluster.
	Helm CLI	Version 3.x or higher for managing chart deployments.
Docker Compose	Docker Engine	Installed and running on the host.
Docker Compose	Docker Compose	Version 2.x or higher.
Standalone Binary	cURL	Used to pull the binary from the OCI registry.
Standalone Binary	cosign	(`Recommended`) Used to verify the binary signature.

To create a new channel:

Log in to Strata Cloud Manager.
Navigate to AI SecurityAI Red TeamingNetwork Channels and Add Network channel.
Enter the Channel Name.
(Optional) Add a description.
Add Channel.

Once the channel is created, you will see the channel details along with the instructions to install and setup the client in your infra.
Set up the Network Channel client by using one of the following deployment methods. Each method is independent, so follow only the one that matches your infrastructure.
Once the channel is validated and online, it's ready to be used to create a target.

Set Up the Network Channel Client Using Kubernetes (Helm)

Follow these steps for setting up the Network Channel client using Kubernetes (Helm) and connecting to the channel.

Setup network.
Download the client to your desired location. Ensure the location meets the following requirements:
- Network Access: Outbound (bidirectional) access to api.sase.paloaltonetworks.com,auth.apps.paloaltonetworks.com,registry.ai-red-teaming.paloaltonetworks.com.
- Target Access: Access to all intended targets that will later be added via this channel. Any domains should also be resolvable if applicable.
Configure Docker Registry.

Create a pull secret using your tenant credentials:
```
kubectl create secret docker-registry airs-pull-secret \
--docker-server=registry.ai-red-teaming.paloaltonetworks.com \
--docker-username=********** \
--docker-password=**********
```
helm registry login registry.ai-red-teaming.paloaltonetworks.com \ --username=********** \ --password=**********
The docker pull secret is common across your tenant and can be generated only once.
To view the username and password, click the eye icon or copy to clipboard icon.
Create Service Account.
The client requires a service account to authenticate with the server. Follow the steps below to create one, or contact your admin if you lack the required permissions.
1. Enter a name and description for the service account.
2. Copy and save the Client ID and Client Secret.
3. Assign the Superuser role.

Install the Network Channel client in your Kubernetes cluster.

helm install panw-network-client oci://registry.ai-red-teaming.paloaltonetworks.com/<TENANT_REGISTRY_PATH>/red-teaming-onprem/charts/panw-network-client:<VERSION> \
--set config.clientId=<CLIENT_ID> \
--set config.clientSecret=<CLIENT_SECRET> \
--set config.channelId=<CHANNEL_ID>

Verify Connection and Validate Channel.

Check the logs to ensure everything is configured correctly. Look for a message that says: "Connected to the server". Alternatively, you can select the Validate Channel to confirm the connection. If successful, the channel status will update to Online.

Set Up the Network Channel Client Using Docker Compose

Follow these steps for setting up the Network Channel client using Docker Compose and connecting to the channel.

Setup network.
Ensure the host meets the following requirements:
- Network Access: Outbound (bidirectional) access to api.sase.paloaltonetworks.com,auth.apps.paloaltonetworks.com,registry.ai-red-teaming.paloaltonetworks.com.
- Target Access: Access to all intended targets that will later be added via this channel.
Configure Docker Registry.
Log in to the registry. This works the same on amd64 and arm64 hosts: the published images are multi-arch, so Docker pulls the matching one automatically.
```
docker login registry.ai-red-teaming.paloaltonetworks.com \
--username=********** \
--password=**********************************
```
The docker pull secret is common across your tenant and can be generated only once.
Create Service Account.
The client requires a service account to authenticate with the server. Follow the steps below to create one, or contact your admin if you lack the required permissions.
1. Enter a name and description for the service account.
2. Copy and save the Client ID and Client Secret.
3. Assign the Superuser role.

Install Client.

Create a .env file with your credentials, then start the client:

cat > .env <<'EOF'
CLIENT_ID=<CLIENT_ID>
CLIENT_SECRET=<CLIENT_SECRET>
CHANNEL_ID=<CHANNEL_ID>
EOF
…/pairs-redteam-prd-fckx/red-teaming-onprem/stable/nb-client-compose:<VERSION>

Verify Connection & Validate Channel.

Check the logs to ensure everything is configured correctly. Look for a message that says: "Connected to the server". Alternatively, you can select the Validate Channel to confirm the connection. If successful, the channel status will update to Online.

Set Up the Network Channel Client Using Standalone Binary

Follow these steps for setting up the Network Channel client using the standalone binary and connecting to the channel.

Setup network.
Ensure the host meets the following requirements:
- Network Access: Outbound (bidirectional) access to api.sase.paloaltonetworks.com,auth.apps.paloaltonetworks.com,registry.ai-red-teaming.paloaltonetworks.com.
- Target Access: Access to all intended targets that will later be added via this channel. Any domains should also be resolvable if applicable.
Set Registry Credentials.
The files download over HTTPS with your tenant registry credentials. Set them once for the downloads below:

Requires curl on this host.
```
export REGISTRY_USER=**********
export REGISTRY_TOKEN=************************************
```
The registry token is common across your tenant and can be generated only once.
Create Service Account.
The client requires a service account to authenticate with the server. Follow the steps below to create one, or contact your admin if you lack the required permissions.
1. Enter a name and description for the service account.
2. Copy and save the Client ID and Client Secret.
3. Assign the Superuser role.

Install Client.

Pick your architecture, then download, extract and run. Both are always published together.

amd64
arm64

Download the tarball

curl -fLO -u "$REGISTRY_USER:$REGISTRY_TOKEN" \
  "https://registry.ai-red-teaming.paloaltonetworks.com/files/pairs-redteam-prd-fckx/red-teaming-onprem/stable/network-broker-client:<VERSION>-standalone-linux-amd64/airt-nb-client-linux-amd64-<VERSION>.tar.gz"

Extract

tar -xzf airt-nb-client-linux-amd64-1.9.0.tar.gz

Run the client

CLIENT_ID=<CLIENT_ID> \
CLIENT_SECRET=<CLIENT_SECRET> \
CHANNEL_ID=<CHANNEL_ID> \
./nb-client

Optional: verify the signature and checksum.

Requires cosign. Run it next to the downloaded tarball.

BASE=https://registry.dev.ai-red-teaming.paloaltonetworks.com/files/pairs-redteam-dev-v4a1/red-teaming-onprem/dev/network-broker-client:1.9.0-standalone-linux-amd64
for f in SHA256SUMS SHA256SUMS.sig; do
  curl -fLO -u "$REGISTRY_USER:$REGISTRY_TOKEN" "$BASE/$f"
done
# The Palo Alto Networks signing public key for this build.
cat > cosign.pub <<'EOF'
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEn35mv5ZMx62Bk75KKG+6hxQNJXQn / 
YpedybXpzsnWp7JOA3/KGN/CNR9i+PqVcKv2pxEd+ar+l9Wif4XToI1peA==
-----END PUBLIC KEY-----
EOF
cosign verify-blob \
  --key cosign.pub \
  --signature SHA256SUMS.sig \
  --insecure-ignore-tlog=true \
  SHA256SUMS \
  && sha256sum -c --ignore-missing SHA256SUMS

Verify Connection & Validate Channel.

Check the logs to ensure everything is configured correctly. Look for a message that says: "Connected to the server". Alternatively, you can select the Validate Channel to confirm the connection. If successful, the channel status will update to Online.

Manage Channels

To manage channels:

Log in to Strata Cloud Manager.
Navigate to the AI SecurityAI Red TeamingNetwork Channels in the sidebar.

This page lists all the channels added with their details.

You can select the channel name to view the detailed overview of the channel that includes the channel validation details along with channel installation and setup information for each deployment methods.
You can now view and track the versions of all Network Channels clients. The Network Channel summary displays which channels have outdated clients, while the Channel Overview page shows instance-level information including hostname, IP address, connection time, and specific version for each client. When updates are available, passive notification is displayed with direct links to upgrade documentation, helping you maintain current deployments and stay up to date with the Network Channels client version history.

Additional Client Configurations

Use these configurations to upgrade the Network Channel client and to configure custom certificate and proxy support after you set up the client.

Client Upgrades
Kubernetes (Helm) Deployments
Run the following command to upgrade the chart to your target client version.
```
helm upgrade panw-network-client oci://…/charts/panw-network-client --version <VERSION> --reset-then-reuse-values \
--set config.clientId=<CLIENT_ID> \
--set config.clientSecret=<CLIENT_SECRET> \
--set config.channelId=<CHANNEL_ID>
```
Docker Compose Deployments
Run from the directory with .env.
```
docker compose -f
oci://registry.ai-red-teaming.paloaltonetworks.com/pairs-redteam-prd-fckx/red-teaming-onprem/stable/nb-client-compose:<VERSION> up -d -y
```
Standalone Binary Deployments
1. Stop the running client completely to prevent any active file conflicts.
2. Download and extract the updated standalone binary files to your directory.
3. Restart the application to initialize the newer version.
Custom SSL/TLS Support
Kubernetes (Helm) Deployments (SSL Support)
- Custom SSL is supported on client version 1.0.4 or higher.
- To enable custom SSL, set config.disableSSLVerification=true.
```
helm upgrade panw-network-client oci://registry.ai-red-teaming.paloaltonetworks.com/pairs-
redteam-prd-fckx/red-teaming-onprem/charts/panw-network-client:1.0.4 \
--set config.clientId=<CLIENT_ID> \
--set config.clientSecret=<CLIENT_SECRET> \
--set config.channelId=<CHANNEL_ID> \
--set config.disableSSLVerification=true
```
This setting disables SSL certificate verification. Ensure you trust the endpoint you are connecting to.
For production environments with valid SSL certificates, this setting is not required.
Custom SSL certificates are typically used in on-premises or private cloud deployments with self-signed or internal CA certificates.
Docker Compose Deployments (TLS Support)
```
SSL_CERT_FILE=<system CAs + your CA>.pem
docker compopse -f oci://registry.dev.ai-red-teaming.paloaltonetworks.com/pairs-redteam-dev-v4a1/red-teaming-onprem/stable/docker-compose.custom-ca.yml -d -y
```
Standalone Binary Deployments (TLS Support)
SSL_CERT_FILE=<system CAs + your CA>.pem CLIENT_ID=<CLIENT_ID> \ CLIENT_SECRET=<CLIENT_SECRET> \ CHANNEL_ID=<CHANNEL_ID> \ ./nb-client

Proxy Configuration

Kubernetes (Helm) Deployments

To configure proxy settings for the Network Channels client, use the following additional parameters (available in client version 1.0.5 and above):

config.noProxy
config.httpProxy
config.httpsProxy

helm install panw-network-client oci://registry.ai-red-teaming.paloaltonetworks.com/pairs-redteam-prd-fckx/red-teaming-onprem/charts/panw-network-client:1.0.5 \
--set config.clientId=<CLIENT_ID> \
--set config.clientSecret=<CLIENT_SECRET> \
--set config.channelId=<CHANNEL_ID> \
--set config.noProxy= \
--set config.httpProxy= \
--set config.httpsProxy=

Docker Compose Deployments

HTTP_PROXY=<HTTP_PROXY> \
HTTPS_PROXY=<HTTPS_PROXY> \
NO_PROXY=<NO_PROXY> \
docker compose -f oci://registry.dev.ai-red-teaming.paloaltonetworks.com/pairs-redteam-dev-v4a1/red-teaming-onprem/dev/nb-client-compose:<version> up -d -y

Standalone Binary Deployments

HTTP_PROXY=<HTTP_PROXY> \
HTTPS_PROXY=<HTTPS_PROXY> \
NO_PROXY=<NO_PROXY> \
CLIENT_ID=<CLIENT_ID> \
CLIENT_SECRET=<CLIENT_SECRET> \
CHANNEL_ID=<CHANNEL_ID> \
./nb-client

Network Channels

Network Channels Client Versions

Prisma AIRS

Networks Channels Management

Prisma AIRS

Networks Channels Management

Create Channel

Set Up the Network Channel Client Using Kubernetes (Helm)

Set Up the Network Channel Client Using Docker Compose

Set Up the Network Channel Client Using Standalone Binary

Manage Channels

Additional Client Configurations

Activation and Onboarding

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Network Security

Endpoints

Visibility & Monitoring

FedRAMP

Hardware Reference

Hardware Quick Start Guides

Virtual ION Deployment

3rd Party Integrations

Prisma SD-WAN Experts Corner

Best Practices

Experts Corner

Resources

Network Security Platform