Create a Configuration Profile for the Prisma Access Agent

Create a Configuration Profile for the Prisma Access Agent

Where Can I Use This?

What Do I Need?

Prisma Access (Managed by Strata Cloud Manager) Prisma Access (Managed by Panorama) NGFW (Managed by Panorama)

For Prisma Access deployments: Minimum Required Prisma Access Version: 5.1 Preferred or Innovation Prisma Access license with the Mobile User subscription For NGFW deployments: Minimum required PAN-OS version: 11.2 Prisma Access Agent license for NGFW deployments For all deployments: Prisma Access Agent version: 25.1.0.14 macOS 14 and later desktop devices Contact your Palo Alto Networks account representative to activate the Prisma Access Agent feature

Create and deploy a configuration profile for Prisma Access Agents that defines how the Prisma Access Agent is configured on managed macOS devices. For example, you can set up the configuration profile to automatically load system extensions to provide a seamless experience for users running the Prisma Access Agent to access the internet, SaaS applications, and private applications and resources in your organization.

The following extensions are needed for the Prisma Access Agent:

• securityExtension
• networkExtension

After the agent has been deployed, you can run the systemextensionsctl list command on an endpoint to verify that the extensions have been installed:

If you previously deployed other Palo Alto Networks apps such as GlobalProtect and Cortex XDR to your endpoints, when deploying the system extensions via mobile device management (MDM) software, the configuration profiles for Prisma Access Agent and the other Palo Alto Networks apps must include the Allowed System Extension and Removable System Extension settings. If only one of the profiles has the removable system extension, the uninstallation of Prisma Access Agent won’t complete.

1. Create a Jamf Smart Computer Group to target specific managed macOS devices for the installation of the Prisma Access Agent.
2. Create a configuration profile for the Prisma Access Agent.

   1. In Jamf Pro, select ComputersConfiguration ProfilesNew.
   2. Specify General settings:

      • Name = Enter a display name for the configuration profile
      • Level = Computer Level

      
3. Create a payload to configure how Prisma Access Agent notifications are displayed on the end users' devices.

   1. Select OptionsNotificationsAdd.
   2. For Bundle ID, enter com.paloaltonetworks.pang.
   3. Specify how you want alerts and notifications for the Prisma Access Agents to appear on the end users' devices. For example:

      • Critical Alerts = Enable
      • Notifications = Enable
      • Banner alert type = Temporary
      • Notifications on Lock screen = Display
      • Notifications in Notification Center = Display
      • Badge app icon = Display
      • Play sound for notifications = Enable

      

   4. Save your settings.
4. Create a payload to configure access settings for the Prisma Access Agent.

   1. If you saved your settings in the previous step, click Edit.
   2. Select OptionsPrivacy Preferences Policy ControlConfigure
   3. In the App Access section, specify the values as shown for the following fields:

      • Identifier = com.paloaltonetworks.pang.securityextension
      • Identifier Type = Bundle ID
      • Code Requirement =

        identifier "com.paloaltonetworks.pang.securityextension" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = PXPZ95SK77

      • APP OR SERVICE = SystemPolicyAllFiles
      • ACCESS = Allow

      

   4. Create a second App Access section by clicking the plus sign (+).

      

   5. In the second App Access section, specify the values as shown for the following fields:

      • Identifier = com.paloaltonetworks.pang
      • Identifier Type = Bundle ID
      • Code Requirement =

        identifier "com.paloaltonetworks.pang" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = PXPZ95SK77

      • APP OR SERVICE = SystemPolicyAllFiles
      • ACCESS = Allow

      

   6. Save your settings.
5. Create a payload to automatically load Prisma Access Agent system extensions on the end users' devices.

   1. If you saved your settings in the previous step, click Edit.
   2. Select System ExtensionsConfigure.
   3. (Optional) Enter a Display Name.
   4. Specify the values as shown for the following fields:

      • System Extension Types = Allowed Team Identifiers
      • Team Identifier = PXPZ95SK77

      

   5. Save your payload settings.
6. Configure a VPN payload to specify how the device connects to your wireless network via the tunnel.

   1. Select OptionsVPNConfigure.
   2. Enter a Connection Name.
   3. For the VPN Type, select Per-App VPN.

      

   4. Specify the values as shown in the following fields:

      • Per-App VPN Connection Type = Custom SSL
      • Identifier = com.paloaltonetworks.pang
      • Server = A placeholder IP address such as 8.8.8.8

      

   5. Save your settings.
7. Set the scope for the configuration profile.

   1. Edit the configuration profile.
   2. Select Scope and Add the Smart Computer Group that you created to target the specific managed macOS devices for the installation of the Prisma Access Agent.

      

   3. Save the scope of the profile. The devices in the selected computer group or groups will be targeted for the distribution of the configuration profile.
8. To verify the status of the configuration profile installation:

   1. In Jamf Pro, select ComputersConfiguration Profiles.
   2. Find the configuration profile that you set up and select View.
   3. Select the log that you want to view:

      

   4. To show the configuration profiles that have been installed, select InventoryProfiles.

      To show the status of the configuration profiles that are pending or failed the push, select Management and view the Pending Commands or Failed Commands.
9. After the profile has been deployed, verify the status of the profile installation on a macOS endpoint:

   1. In System Settings, select Profiles.
   2. Double-click the Prisma Access Agent profile that you deployed.
   3. Review the profile settings to ensure that the correct settings have been deployed.