>
    Strata Copilot
    Panorama Managed Prisma AIRS AI Runtime Onboarding Prerequisites
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma AIRS
    3. Activation & Onboarding
    4. Panorama Managed Prisma AIRS AI Runtime: Network Intercept Overview
    5. Panorama Managed Prisma AIRS AI Runtime Onboarding Prerequisites
    Download PDF
    Prisma AIRS

    Panorama Managed Prisma AIRS AI Runtime Onboarding Prerequisites

    Table of Contents

    Panorama Managed Prisma AIRS AI Runtime Onboarding Prerequisites

    Discovery onboarding prerequisites for Panorama.
    Where Can I Use This?What Do I Need?
    • Prisma AIRS AI Runtime: Network Intercept managed by Panorama
    Follow these steps to prepare your environment to support the firewall discovery on Panorama.
    After completing the prerequisite steps, proceed to the cloud-specific onboarding workflow in Strata Cloud Manager. The cloud account helps configure your cloud account details and generate an onboarding Terraform template. Next, you download and apply the template in your cloud environment for cloud assets discovery.
    1. Deploy Panorama in standalone or High Availability (HA) mode.
      • Navigate to Panorama web (Interface→ PANORAMA→ High availability).
      • Copy and save the active/passive Panorama IP address.
    2. Generate the VM Auth Key on Panorama.
    3. Optional For Panorama managed firewalls deployed on public clouds:
      • Add the public IP address of the firewall under Panorama > Setup > Interfaces > Management.
      • Select the Network Connectivity Services to allow on the interface (such as SSH access).
      • Click OK to save your changes to the interface.
      • Select Commit > Commit to Panorama and Commit your changes.
    4. Panorama CloudConnector Plugin 2.1.0 (if not already installed).
      • Verify the connection status of the Panorama cloud connector (It may take more than 30 minutes for Panorama to get connected to Strata Logging Service).
      • Install the Panorama Device Certificate.
      • Enable the cloud connector plugin on your Panorama if not already enabled:
        admin@Panorama> request plugins cloudconnector enable basic
      • Check the cloud connector plugin connection: 
        admin@Panorama> show plugins cloudconnector status
        Output: 
        pass
CloudConnector plugin is enabled. Cloud NGFW functionality is disabled. 
Connectivity to region https://prod.us.secure-policy.cloudmgmt.paloaltonetworks.com and license check is a success.
    5. Enterprise DLP Plugin on Panorama 5.0.5 or above.
    6. Select the Telemetry region as Americas.
      While enabling telemetry is optional for this feature, it's recommended to set the Telemetry region to Americas if you have not already configured it.
    7. Optional Onboard Panorama to Strata Logging Service.
      This is an optional step if you want the Prisma AIRS: Network intercept to forward the logs to Strata Logging Service and Panorama to retrieve the logs from Strata Logging Service. Refer Onboarding the firewalls to Strata Logging Service for details.
    8. Enable automatic configuration push to managed firewalls on the template stack on Panorama before onboarding Prisma AIRS: Network intercept.
      Panorama pushes the AI profiles to the AI cloud service.
    9. Select Commit > Commit to Panorama and Commit your changes.

    What’s Next

    Follow the onboarding workflow for your cloud provider to enable the discovery of your cloud assets.

    © 2026 Palo Alto Networks, Inc. All rights reserved.