Features Introduced in Prisma Access 1.8

Prisma Access introduces changes to licensing. The new licensing model allows you to implement and use the capabilities of Prisma Access aligned to your business needs in a way that delivers the fastest return on investment. Whether your applications are migrating to the cloud, your users are working from anywhere, or if you are looking to gain operational efficiencies, Prisma Access offers the relevant type of license for your deployment.

Choose from the following license editions:

ZTNA SIG is available for Prisma Access for Mobile Users only; you can use all other editions with Mobile Users, Remote Networks, or both mobile users and remote networks.

All license editions are available for Local and Worldwide Prisma Access locations. When you purchase a license with Worldwide locations, you can deploy Prisma Access in all Prisma Access locations. When you purchase a license with Local locations, you can select up to 5 Prisma Access locations. For more details about what is available with the new licenses, see the Prisma Access Licensing Guide.

You allocate bandwidth for remote networks at an aggregate level per compute location.

The aggregate bandwidth model is available for all new Prisma Access 1.8 deployments and for existing deployments that have not had any remote networks onboarded before upgrading to 1.8. If you have an existing Prisma Access deployment that has onboarded remote networks and you then upgrade to Prisma Access 1.8, this model does not apply and you still apply bandwidth per location.

Each location has a corresponding compute location for which bandwidth is allocated, and all sites you onboard in a compute location share that allocated bandwidth. For example, you want to onboard four branch offices using remote networks in the Singapore, Hong Kong, Thailand, and Vietnam locations. All these locations map to the Asia Southeast compute location. If you allocate 200 Mbps bandwidth to the Asia Southeast compute location, all four branch offices will share the 200 Mbps of bandwidth.

If one or more sites are not using a large amount of bandwidth, Prisma Access makes the remaining bandwidth available to other sites in that compute location.

Prisma Access introduces an enhancement to the API you use to retrieve IP addresses that allows you to reserve gateway and portal IP addresses for mobile user locations ahead of time, before you enable them. This ability lets you add the mobile user egress IP addresses to your organization’s allow lists before you onboard the locations, which in turn gives mobile users access to external SaaS apps immediately after you onboard the locations.

The API response also includes the public IP pool subnets that are the source for the egress IP addresses for the requested locations.The gateway and portal addresses of any locations you add will be a part of this subnet. Adding the subnets to your allow lists provides for future location additions without allow list modification and is beneficial if your organization’s allow list size is limited.

The IP addresses and subnets are valid for 90 days after you retrieve them and expire after the validity period if you do not use them.

Prisma Access offers the following enhancements to traffic steering:

Prisma Access increases its maximum fully-supported remote network bandwidth from 300 Mbps to 500 Mbps, and 500 Mbps is now supported with SSL decryption.

If you have a Prisma Access for Users license, you can quickly resolve mobile user connection, performance, and access issues by having GlobalProtect users generate and send an easy to read, comprehensive report from the end user’s endpoint to Strata Logging Service for further analysis.

You are required to use CLI to set up a client certificate to be used between the GlobalProtect app and Strata Logging Service. See Set Up GlobalProtect Connectivity to Strata Logging Service for details.

Prisma Access supports custom and scheduled reports from the Panorama that manages Prisma Access.

The ability to run custom and scheduled reports requires the Cloud Services plugin 1.8 and a minimum Panorama version of 10.0.2.

To optimize performance and improve latency, Prisma Access adds a new compute location in Japan and also changes the mapping of the following locations:

If you add the locations after your organization installs the 1.8 plugin, Prisma Access associates the new compute locations automatically.

Since you need to allow time to delete and add the existing location and change your allow lists, Palo Alto Networks recommends that you schedule a compute location change during a maintenance window or during off-peak hours.

Prisma Access will offer the following enhancements to assist you when sharing public address space externally and internally with private apps: