Pre-Installation and Product Activation Requirements

Pre-Installation Requirements:

Deployment Type (New or Existing)
—New
Prisma Access
deployments are supported in a FedRAMP Moderate environment. Upgrades from an existing
Prisma Access
deployment to a FedRAMP Moderate
Prisma Access
deployment are not supported.
Required SKUs
—When you purchase
Prisma Access
for a FedRAMP Moderate deployment,
Prisma Access
requires SKUs that are specific to the FedRAMP environment. Work with your authorized Palo Alto Networks representative or partner to make sure that you purchase the correct SKUs for your FedRAMP Moderate deployment.
Use only the Panorama versions, GlobalProtect versions, and Cloud Services plugin versions listed in Required Panorama, Plugin, and PAN-OS Dataplane Versions.
Allow List Cortex Data Lake Public IP Addresses
—The IP address block that is used by the Cortex Data Lake federal region is 34.67.50.64/28. If your enterprise uses allow lists, be sure to add these IP addresses to your allow lists to make sure that Cortex Data Lake can receive the logs from
Prisma Access
.
Changes to API URLs
—When you run the API script to retrieve the public IP addresses that are used by
Prisma Access
, change the URL for the API from
https://api.gpcloudservice.com/GetPrismaAccessIP/v2
to
https://api.fed.prismaaccess.com/GetPrismaAccessIP/v2
.
If your Panorama appliance uses a uses a proxy server (
Panorama
Setup
Service
Proxy Server
), or if you use SSL forward proxy decryption with
Prisma Access
, be sure to add the api.fed.prismaaccess.com URL to your allow list on the proxy or proxy server.
GlobalProtect Portal Name Change
—The default portal hostname for a
Prisma Access
FedRAMP Mobile Users—GlobalProtect deployment is different from a non-FedRAMP deployment. The portal name is
<portal-name>
.fed.prismaaccess.com. instead of
<portal-name>
.gpcloudservice.com.
Support Requirements
—
Prisma Access
FedRAMP Moderate requires Palo Alto Networks US Government Support Services, which includes 24x7 support for United States personnel on United States soil.

Activation Requirements

—When you activate and install your

Prisma Access

deployment, the activation and installation tasks are similar to a non-FedRAMP deployment. However you must select a

Cortex Data Lake

region of

United States—Government

during product activation.