Your Prisma Access Agent License for NGFW Deployments
Understand the licensing features for Prisma Access Agent for NGFW
deployments.
Where Can I Use This?
What Do I Need?
NGFW (Managed by Panorama)
PAN-OS version 11.2.x
Prisma Access Agent version 25.1.0.14
Prisma Access Agent license for NGFW deployments
macOS 14 and later or Windows 10 version 2024 and later desktop
devices
Prisma Access Agent, a next-generation mobile access agent from Palo Alto Networks,
offers enhanced security, performance, and manageability for remote access users. It
enables you to remotely troubleshoot endpoint issues and collect agent logs and
additional data such as OS and endpoint events without intervention from end users. Prisma Access Agent provides in-product user-group based agent upgrades with
rollback functionality, enabling gradual upgrades while maintaining business continuity.
To aid in gradual adoption, Prisma Access Agent can coexist with existing
GlobalProtect™ deployments in your current setup.
Review the following licensing options and requirements to help you effectively deploy
and manage Prisma Access Agent on your NGFW systems, ensuring integration with your
existing infrastructure and adherence to licensing terms.
Licensing Options
You can obtain Prisma Access Agent for your NGFW deployments through two main
options:
Platform-specific SKUs for NGFW deployments, which follow a structure similar to
GlobalProtect using the format PAN--PAA, such as PAN-<PA-1420>-PAA. These
are available for various NGFW platforms and support one-, three-, and five-year
subscription terms.
You can also get high availability pair SKUs in the
format PAN--PAA-HA2.
Existing Enterprise License Agreement (ELA) SKU, PAN-ENT-ELA-SUB, which includes
Prisma Access Agent licenses without additional cost.
License Activation and Management
To activate Prisma Access Agent, you need to install the license on your NGFW firewall.
This will replace any existing GlobalProtect licenses. You will notice the licensing
page updates, with the heading changing from GlobalProtect
Gateway to Gateway, and the description
updating to Gateway License for Prisma Access Agent.
Key Licensing Requirements and Considerations
Your Prisma Access Agent licensing provides Windows and macOS endpoints without
enforcement. You can have either GlobalProtect licenses or Prisma Access Agent
licenses on an NGFW firewall, but not both simultaneously. The Prisma Access Agent
license lets you connect from both the GlobalProtect app and Prisma Access Agent.
Your maximum number of supported sessions is defined by your hardware model's
platform limit.
For high availability deployments, you must install identical licenses on both
devices. You can use the new license on older PAN-OS releases, ensuring
compatibility with your existing infrastructure.
Evaluation and Expiration
You can evaluate Prisma Access Agent for up to 90 days, with the possibility of
extension if needed. You're allowed to evaluate it on NGFWs with existing
GlobalProtect subscriptions.
Additional Licensing Details
Your LAB and NFR licenses include the Prisma Access Agent license. You can get
renewal SKUs in the format PAN--PAA-R, such as PAN-<PA-1420>-PAA-R. When you
purchase a Prisma Access Agent or ELA SKU, you also get Strata Cloud Manager Essentials. If you
need additional support, you can obtain a Customer Success & Professional
Service SKU (PAN-CONSULT-NGFW-QS-PAA-REMOTEACCESS).
