Common Services: Subscription & Tenant Management
    : Activate a License for Panorama-Managed Prisma Access China Through Common Services
    Focus
    Download PDF
    Focus
    1. Home
    2. Common Services
    3. Common Services: Subscription & Tenant Management
    4. Panorama-Managed Prisma Access and Add-ons License Activation
    5. Activate a License for Panorama-Managed Prisma Access China Through Common Services
    Download PDF

    Common Services: Subscription & Tenant Management

    Activate a License for Panorama-Managed Prisma Access China Through Common Services

    Table of Contents

    Activate a License for Panorama-Managed Prisma Access China Through
    Common Services

    Learn how to activate your single tenant Panorama-managed Prisma Access China license.
    Where Can I Use This?
    What Do I Need?
    • Panorama located in mainland China
    • Prisma Access license with optional add-ons
    • Activation link
    • Cortex Data Lake (CDL)
    • Role: Multitenant Superuser
    This process applies to only single tenant Panorama-managed Prisma Access China license activation. The Panorama you use to manage Prisma Access China must be installed and located in mainland China. If it is a hardware appliance, it must be based in mainland China; if it is a VM-series Panorama, the processing location must be in mainland China. These license activation instructions assume that you have already deployed your VM-series or hardware Panorama with the China-specific Panorama image.
    Make sure that you have reviewed the requirements and prerequisites for configuring a Prisma Access China deployment. Be aware that the CLI commands must be completed prior to generating your one-time password (OTP).
    1. After you receive an email from Palo Alto Networks identifying the license you are activating, including all your add-ons and capacities, select
      Get Started with Prisma SASE
       in your email to begin the activation process.
    2. Log in with your email address.
      • If you have a Palo Alto Networks Customer Support account, then enter the email address you used when you registered for that account and select
        Next
        .
      • If you do not have a Palo Alto Networks Customer Support account, then
        Create a New Account
        Password
        Next
        .
      The service uses this email address for the user account assigned to the tenant that you use for this license. This tenant, and any others created by this email address, will have the
      Multitenant Superuser
       role.
    3. Choose the
      Customer Support Account
       number that you want to use to claim the license.
    4. Choose
      Panorama
       management for your setup and management method.
    5. Select
      Create New
       from the Panorama drop-down and copy the Panorama Serial Number for use in step 16.
    6. Add-ons
       are enabled by default based on your contract.
      • Level 1 support includes the following add-ons:
        • Additional SC for Private App Access
        • Site-to-Site and User-to-Site Access
      • Level 2 support includes the following add-ons:
        • Additional SC for Private App Access
        • Site-to-Site and User-to-Site Access
        • CASB Bundle for PA China
        • DLP (individual)
        • IoT Security for PA China
        • SaaS Inline (individual)
    7. Select
      Cloud Identity Engine
       regardless if you intend to use it now or if you might use it in the future.
    8. Agree to the Terms and Conditions
      .
    9. Activate Now
      . The products and add-ons that you are activating (such as Prisma Access China or Cortex Data Lake) are now provisioned. As the subscriptions are activating, the progress status will display. You now have a tenant provisioned with instances of the products that you purchased. The tenant has one user — the Customer Support account that you used when you began this process.
    10. After the provisioning is complete, you receive an email confirmation.
    11. In the Serial Number field of the Panorama UI, enter the serial number that you copied from the license activation page, and then select
      OK
      .
      Panorama will become unresponsive after you select OK. If it does not return after a few minutes, refresh your browser.
    12. Change the Panorama update server location to the update server in China.
      1. In Panorama, go to
        Panorama
        Setup
        Services
         and click the gear to edit the
        Settings
        .
      2. Change the update server to
        updates.paloaltonetworks.cn
        .
      3. Update the DNS servers and NTP servers to the servers of your choice.
    13. Perform a local commit to Panorama from
      Commit
      Commit to Panorama
      .
    14. Upgrade the Cloud Services plugin to the minimum required version.
      1. From the Panorama that manages Prisma Access, select
        Panorama
        Plugins
         and click
        Check Now
         to display the latest Cloud Services plugin updates.
      2. Download
         the plugin version you want to install.
      3. After downloading the plugin,
        Install
         it.
    15. Open a CLI session with the Panorama appliance and enter the following commands to make sure that the Panorama appliance points to the CSP that contains Prisma Access China and Panorama Assets to retrieve its one-time password (OTP):
      debug plugins cloud_services set-csp-endpoint api.sb.prismaaccess.com
      debug plugins cloud_services set-csp-trusted-endpoint api-trusted.sb.prismaaccess.com
      request certificate secure-bridge enable
      If you do not enter these commands, the Panorama appliance will not be able to retrieve the OTP or certificate.
    16. Generate your one-time password (OTP) from
      Common Services
      Tenant Management
      Tenant name
      Generate OTP
       for setting up Panorama.
    17. After you validate your OTP, the Cloud Services page will become available. However, it might take up to two hours for the China region of CDL to show up under Settings; until it does, you can't save your configuration.

    Recommended For You

    © 2023 Palo Alto Networks, Inc. All rights reserved.