Activate Your Prisma Access License
Focus
Focus
Prisma Access

Activate Your Prisma Access License

Table of Contents

Activate Your
Prisma Access
License

Learn how to activate your
Prisma Access
license.
Where Can I Use This?
What Do I Need?
  • Prisma Access (Cloud Management)
  • Prisma Access (Panorama Managed)
Prisma Access
provides a flexible licensing scheme so that you can purchase just what you need to secure your remote networks and mobile users.
Our licensing model allows you to consume the capabilities of
Prisma Access
aligned to your business needs in the manner that delivers the fastest return on investment (ROI).
Both Cloud Management and Panorama managed options for
Prisma Access
support this licensing model. You can choose your
Prisma Access
edition based on your access needs and security goals.
Managing
Prisma Access
There are two ways you can manage
Prisma Access
:
  • Prisma Access (Cloud Management)
    , with Strata Cloud Manager
  • Prisma Access (Panorama Managed)
You can't switch between the management interfaces after you activate your Prisma Access license. So, you must decide how you want to manage
Prisma Access
before you follow the activation guides.
Follow the instructions for activating and installing Cloud Managed or Panorama Managed
Prisma Access
.

Cloud Management

After you purchase a
Prisma Access
license, you’ll receive an email with an activation link. The link launches a guided workflow that’ll get you up and running with
Prisma Access
.
The instructions here are for activating
Prisma Access
licenses if you’re using the
Prisma Access
app as your management interface. If you are planning to use Panorama to manage
Prisma Access
, follow the instructions for activating and installing
Prisma Access (Panorama Managed)
.

Activate Licenses and Add-Ons

Prisma Access
activation varies depending on the status of your transition to the Prisma™ SASE Platform. See the table to learn your status and how to proceed.
First Time Activation
Transitioned to Prisma SASE
Pre-Transition
Are you brand new to
Prisma Access (Cloud Management)
(You activated
Prisma Access
after August 2022)? You're already on the Prisma SASE Platform. After you purchase your
Prisma Access
licenses, you’ll receive an activation email. The email includes a link that launches a guided activation.
Select
Get Started with Prisma SASE
and begin the activation process.
After activation, use Simple Single Tenant License Activation and Subscription Management to activate licenses and manage subscriptions and tenants. To learn more, see Use Common Services: Subscription & Tenant Management.
Was your
Prisma Access
tenant recently transitioned to the Prisma SASE Platform? With Prisma SASE, there's a new way to manage administrator roles and access using Simple Single Tenant License Activation. After your
Prisma Access
instance is transitioned to a tenant, you will no longer see a
Prisma Access
app tile on the hub. However, there will be a button on the hub to navigate to sase.paloaltonetworks.com. From there, use Simple Single Tenant License Activation and Subscription Management to activate licenses and manage subscriptions and tenants. To learn more, see Use Common Services: Subscription & Tenant Management.
Did you activate you
Prisma Access
before August 2022? You should have already received information about the transition of your
Prisma Access
tenant. You'll receive an email when it's time for you to transition.
Until your transition is complete, continue to activate add-on licenses as you have been doing. Follow the Activate Add-On Licenses (Pre-Transition to Prisma SASE) steps to activate licenses and manage subscriptions.

Activate Add-On Licenses (Pre-Transition to Prisma SASE)

If you are an existing
Prisma Access (Cloud Management)
customer whose
Prisma Access
instance has not been transitioned to the Prisma SASE Platform, you can continue using the existing process until the transition.
  1. Select
    Get Started with Prisma SASE
    and begin the activation process.
  2. Double-check that your licenses are active.
    1. Go to the hub home page.
      Prisma Access
      now shows up on the hub as one of your apps.
      Click on the
      Prisma Access
      icon on the hub to launch the app.
    2. Verify that the Remote Networks and/or Mobile Users tiles on the
      Dashboard
      show the correct amount of bandwidth and/or number of users that you licensed.
    3. After your
      Prisma Access
      tenant and add-ons are transitioned, you will no longer see the app tiles on the hub. However, there will be a toggle to a new hub UI. After the transition, you can use the new hub UI to launch your products.
  3. View and update
    Prisma Access
    role assignments.
    Go to the hub access management page (on the top right of the hub homepage, click the settings gear and select
    Access Management
    ).
    The Access Management page lists all the users in your organization and the roles to which they’re assigned.
    Activating Prisma Access automatically adds you as a
    Prisma Access
    instance administrator (unless you are already an account administrator or a
    Prisma Access
    app administrator—in these cases,
    Prisma Access
    activation does not impact your role).
    As an instance administrator, you can give others within your support account access to the
    Prisma Access
    instance you’ve activated.
  4. Follow the next steps for getting started with Prisma Access:
  5. Verify
    Prisma Access
    License Details
    In
    Prisma Access (Cloud Management)
    , go to the Licenses page to verify your license details (
    Manage
    Prisma Access
    Licenses
    ).
    If you're using Strata Cloud Manager, go to
    Manage
    Configuration
    NGFW and
    Prisma Access
    Overview
    . Select the
    Prisma Access
    configuration scope. Click the link in the
    General Information
    Licenses
    panel.

Panorama

If you have a new
Prisma Access (Panorama Managed)
Access deployment as of August 2022, use
Prisma Access (Panorama Managed)
and Subscription Management to activate licenses and manage subscriptions. Be sure to follow the planning checklist before you begin activation.
If you have already activated your deployment and you need to upgrade your Cloud Services plugin to a new version, use the workflow in the Prisma Access Release Notes (Panorama Managed).
If you have an existing Panorama Managed
Prisma Access
deployment, Palo Alto Networks sends you a notification about the transition of your
Prisma Access
license activation to the Prisma SASE Platform. After the transition, you can only use the Prisma SASE Platform for
License Activation
. You cannot use the other
Common Services
such as
Tenant Management
or
Identity & Access
. Continue to manage your tenants and user role permissions on Panorama as you have been doing.
Prisma Access does not support FIPS-CC mode.

Planning Checklist Before You Activate
Prisma Access

If you are deploying
Prisma Access
for the first time, make sure that you have the following information and resources:
  • Be sure that you have the order fulfillment email that contains the activation links that are required to activate
    Prisma Access
    .
  • If you will use an existing Panorama to manage
    Prisma Access
    , be sure you that the Panorama on which you will install the Cloud Services plugin (which activates
    Prisma Access
    ) is running the minimum Panorama version.
    During product activation, you can select an existing Panorama to manage
    Prisma Access
    , if you have registered Panorama, installed the licenses, and activated the support license on the Customer Support Portal (CSP). If you have added the Panorama serial number to the same CSP account on which you want to deploy
    Prisma Access
    , you can select the serial number of this Panorama appliance during installation.
    Alternatively, if you have a licensed Panorama that you have not yet installed, you can select that Panorama during product activation; the installation process provides you with links to register and install Panorama. In either case, the activation process allows the Panorama appliance you select to manage
    Prisma Access
    , and you must make sure that the Panorama appliance is running the minimum software version.
    For a list of the Panorama software versions that are supported with
    Prisma Access
    , see Minimum Required Panorama Software Versions in the Palo Alto Networks Compatibility Matrix.
    Make a note of the serial number of the Panorama appliance; you use that serial number in a later step.
  • Be sure that you have configured a DNS server and NTP server on the Panorama that manages
    Prisma Access
    (
    Panorama
    Setup
    Services
    ). If you do not configure a DNS and NTP server, you cannot verify your account and will have to reinstall the plugin.
  • During
    Prisma Access
    installation, Palo Alto Networks provides you the required roles on the Hub to activate Prisma Access, if those Hub roles are not already present. After you complete installation, you are assigned a role of Instance Admin. If you need additional roles on the Hub to perform system tasks, log in to the Hub, select
    Settings
    Access Management
    , find the
    Account Administrator
    for your organization, and contact them to be assigned additional roles.
  • (
    Deployments Using Panorama Appliances in HA Mode Only
    ) If you plan to use two Panorama appliances in High Availability (HA) mode, to simplify the HA set up, you should configure the Panorama appliances in HA
    after
    you purchase
    Prisma Access
    and Cortex Data Lake auth codes and components and associate the serial number of the primary Panorama appliance on which you plan to install the Cloud Services plugin with the auth codes, but
    before
    you activate and install Panorama Managed Prisma Access. However, you can use the same configuration process for Panorama appliances that already have the plugin installed.

License Activation

Complete the following steps to activate your
Prisma Access
licenses and download and install the Cloud Services plugin.
  1. When you receive the activation email from Palo Alto Networks, select
    Get Started with Prisma SASE
    and begin the activation process.
  2. When setup is complete, copy the one-time password (OTP). You use this when you verify your account on Panorama.
  3. Download and install the Cloud Services plugin.
    See the Palo Alto Networks Compatibility Matrix for the Panorama versions that are supported with the Cloud Services plugin.
    You can either download the plugin from the Customer Support Portal, or you can check for plugin updates directly from Panorama.
    • To download and install the Cloud Services plugin by downloading it from the Customer Support Portal, complete the following steps.
      1. Log in to the Customer Support Portal and select
        Software Updates
        Panorama Integration Plug In
        .
      2. Find the Cloud Services plugin in the Panorama Integration Plug In section and download it.
        Do not rename the plugin file or you will not be able to install it on Panorama.
      3. Log in to the Panorama Web Interface of the Panorama you licensed for use with the
        Prisma Access
        , select
        Panorama
        Plugins
        Upload
        and
        Browse
        for the plugin
        File
        that you downloaded from the CSP.
      4. Install
        the plugin.
    • To download and install the Cloud Services plugin directly from Panorama, complete the following steps:
      1. Select
        Panorama
        Plugins
        and click
        Check Now
        to display the latest Cloud Services plugin updates.
      2. Download
        the plugin version you want to install.
      3. After downloading the plugin,
        Install
        it.
    Installing a newer version of the Cloud Services plugin overwrites the previously installed version. If you are installing the plugin for the first time, after you successfully install, Panorama refreshes and the Cloud Services menu displays on the
    Panorama
    tab.
  4. Retrieve the
    Prisma Access
    license(s).
    1. Select
      Panorama
      Licenses
      and click
      Retrieve license keys from license server
      .
    2. Verify that you have the licenses for the
      Prisma Access
      components you plan to use.
  5. When you try to use the Cloud Services plugin for the first time after installing it, you will be prompted to verify your account. This step ensures that the Panorama serial number is registered to use Prisma Access and enables a secure communication path between the
    Prisma Access
    components and Panorama.
    1. In Panorama, select
      Panorama
      Cloud Services
      Configuration
      and click
      Verify
      .
      If
      Verify
      is disabled, check that you have configured a DNS server and NTP server on
      Panorama
      Setup
      Services
      .
    2. Paste the
      One-time Password
      you copied and click
      OK
      .
      You have ten minutes to enter the OTP before it expires.
  6. Apply device group changes in the
    Prisma Access
    infrastructure.
    Prisma Access
    moves all device groups under the
    Shared
    hierarchy. This step applies the device group changes to your configuration.
    1. Select
      Panorama
      Cloud Services
      Configuration
      Service Setup
      .
    2. Click the gear icon to edit the
      Settings
      .
    3. Make sure that
      Service_Conn_Device_Group
      is selected as the
      Device Group Name
      and
      Shared
      is selected as the
      Parent Device Group
      .
    4. Click
      OK
      .
      Do not click
      Cancel
      , even if you did not make any changes to this page.
  7. Continue to configure your
    Prisma Access
    deployment by Enabling the Service Infrastructure.

Recommended For You