Prisma Access Administrator’s Guide (Panorama Managed)
  • Prisma Access Administrator’s Guide (Panorama Managed)
  • All Documentation
>
Configure Prisma Access for Clean Pipe
Focus
Download PDF
Focus
  1. Home
  2. Prisma
  3. Prisma Access
  4. Create and Configure Prisma Access for Clean Pipe
  5. Configure Prisma Access for Clean Pipe
Download PDF

Configure Prisma Access for Clean Pipe

Table of Contents

Configure Prisma Access for Clean Pipe

To set up Prisma Access for Clean Pipe for your tenants, complete the following steps.
  • Enable Multitenancy and Create a Tenant
  • Complete the Clean Pipe Configuration

Enable Multitenancy and Create a Tenant

To begin the Clean Pipe configuration, you create a multitenant deployment in Panorama and create one or more tenants.
  1. Install and activate Prisma Access for Clean Pipe.
    Prisma Access for Clean Pipe requires a separate license, and activating it creates Clean Pipe-specific tabs in the Cloud Services plugin. The procedure you use to install Prisma Access for Clean Pipe is the same as the procedure you use to activate and install a standard Prisma Access license, including installing the Cloud Services plugin.
  2. Enable multitenancy if you have not done so already.
    1. Select PanoramaCloud ServicesConfiguration.
    2. Select Enable Multitenancy (located on the upper right of the page).
    3. Click OK.
      The Tenants page displays.
    4. In the Options area, select Clean Pipe.
      To configure a tenant for remote networks, mobile users, or both, see Manage Multiple Tenants in Prisma Access.
    5. Enter a Name for the first tenant.
    6. Create and configure a new Access Domain for the first tenant and click OK.
    7. In the Clean Pipe area, enter a Bandwidth (Mbps) for This Tenant.
      Enter a minimum of 100 Mbps for each tenant you create.
    8. Click OK.
  3. Create zones for the tenant and map those zones for the tenant.
    1. Select NetworkZones.
      Make sure that selected the Clean Pipe Template for the tenant you created (cp-tpl-tenant).
    2. Create zones for the tenant (for example, Trust and Untrust).
    3. Select PanoramaCloud ServicesConfiguration and select the Tenant from the drop-down list.
    4. Select the Clean Pipe tab.
    5. Click the gear icon next to Zone Mapping to edit the settings.
    6. Add and Remove the zones you created to map them to trusted and untrusted zones.
  4. Onboard a new Clean Pipe.
    1. Select PanoramaCloud ServicesConfigurationClean Pipe.
    2. Add a new Clean Pipe instance for the tenant, entering the following information:
      • Name—Specify a name for the clean pipe.
      • Bandwidth—Select the Bandwidth to allocate for the clean pipe.
        You can onboard Clean Pipe instances in increments of 100 Mbps, 200 Mbps, 300 Mbps, 400 Mbps, 500 Mbps, 1000 Mbps, 2000 Mbps, 5000 Mbps, and 10000 Mbps. The amount of bandwidth you specify must be within the licensed bandwidth allocation, and it must match the bandwidth of the VLAN attachment you create in the Partner Interconnect.
      • Edge Availability Domain—Select the availability domain you want for the clean pipe. You can choose 1, 2, ANY, or REDUNDANT.
        • Specify ANY for a non-redundant Clean Pipe deployment.
          Make sure that your cloud provider supports this choice; you must also select ANY on the cloud provider side of the partner interconnect. If that choice is not available for your cloud provider, make another choice.
        • To specify two VLAN attachments in the same location in an active/backup configuration in the same location, select REDUNDANT.
          Prisma Access creates two pairing keys for a REDUNDANT configuration (one for each availability zone), and appends the clean pipe name with zone1 for the first availability zone and zone2 for the second availability zone. For example, if you specify a Name of San Francisco, Prisma Access creates two zones named San Francisco-zone1 and San Francisco-zone2.
        Be sure that you configure the first availability zone (zone1) as the primary zone on your CPE.
        You can also build a pair of clean pipes for a single tenant redundancy in different locations; to do so, specify 1 for the first clean pipe in one location and 2 for the second clean pipe in a different location.
      • BGP Peer ASN—Enter the BGP Autonomous System Number (ASN).
        You can specify either a private or public BGP ASN.
        Make a note of this value; you configure it on the customer edge (CE) router when you
        complete the Clean Pipe configuration
        .
      • Location—Select the location.
        We recommend that you use the same location that you use when you
        create the VLAN attachment for the partner interconnect
        .
      • To enable QoS, select QoS, then select the QoS Profile to use with the clean pipe. Clean Pipe QoS shapes on ingress.
  5. Add more Clean Pipe instances as required by repeating Step
    4
    .
    Be sure that each additional Clean Pipe uses a different location.
  6. Commit and push your changes to make them active in Prisma Access.
    1. Select CommitCommit and Push and Edit Selections in the Push Scope.
    2. Select Prisma Access, then select Clean Pipe.
    3. Click OK to save your changes to the Push Scope.
    4. Commit and Push your changes.
  7. Check that your Clean Pipe has been provisioned.
    1. Select PanoramaCloud ServicesStatus.
    2. Select the Tenant from the drop-down list at the top of the page.
    3. Click Status.
      The Clean Pipe status displays.
    4. Hover over the Clean Pipe Config Status and wait until the status changes from Provisioning in Progress to Provisioned.
      This provisioning can take up to 30 minutes.
  8. Click the Network Details tab, click the Clean Pipe radio button, and make a note of the Pairing Key.
    The MSSP CE and Cloud Router IP fields are blank when you start to configure the Clean Pipe. These fields populate after you create the VLAN Attachment when you
    complete the Clean Pipe configuration
    .
    If you specified a REDUNDANT connection, Prisma Access creates two pairing keys, one for each availability zone, and appends the clean pipe name with zone1 for the first availability zone and zone2 for the second availability zone. The following screenshot shows the SanFrancisco clean pipe with a redundant configuration; Prisma Access has created two pairing keys, one for SanFrancisco-zone1 and one for SanFrancisco-zone2.
    Be sure that you configure the first availability zone (zone1) as the primary zone on your CPE.
  9. Complete the Clean Pipe configuration
    .

Complete the Clean Pipe Configuration

To complete configuration of Prisma Access for Clean Pipe, you perform configuration in the Partner Interconnect and in Panorama.
Make sure that you can access and configure the CE and cloud routers on the Partner Interconnect (non-Prisma access) side of the Partner Interconnect.
  1. In the Partner Interconnect side of the configuration, create a VLAN attachment, using the Pairing Key that you retrieved from Panorama.
    For more information about creating VLAN attachments with Partner Interconnects and configuring customer edge (CE) routers to communicate with cloud routers, refer to the Google Cloud documentation at https://cloud.google.com/interconnect/docs/
    Make sure that the location and bandwidth you select matches the Location you specified in Panorama. The service provider you use for the Partner Interconnect uses the pairing key, along with your requested connection location and capacity, to complete the configuration of your VLAN attachment.
  2. After the connection comes up, return to Panorama, select PanoramaCloud ServicesStatusNetwork DetailsClean Pipe and make a note of the MSSP CE and Cloud Router IP addresses.
    These values populate after you enter the Pairing Key on the other side of the VLAN attachment.
  3. Log in to the CE router and perform the following configuration.
    1. Enter the MSSP CE address as the local IP address.
    2. Enter the Cloud Router IP address as the peer IP address.
    3. Enter a BGP ASN that matches the BGP Peer ASN you entered when you configured the Clean Pipe in Panorama.
      Make sure that you enter these values correctly; you cannot change them.
  4. Check the Clean Pipe status.
    1. In Panorama, select PanoramaCloud ServicesStatus, select the Tenant from the drop-down, and check the Clean Pipe’s Status.
      See the list of Prisma Access locations for acceptable values.
      The Deployment Status area allows you to view the progress of onboarding and deployment jobs before they complete, as well as see more information about the status of completed jobs. See Deployment Progress and Status for details.
    2. Select PanoramaCloud ServicesStatusClean Pipe, and click the Monitor tab to see a map with the status of the deployed Clean Pipes.
      Click the tabs below the map to see additional statistics for the Clean Pipes.
      Status tab:
      • Compute Region—The compute region where your cloud service infrastructure is deployed for the clean pipe instance.
      • Name—The name of the clean pipe instance.
      • Allocated Bandwidth (Mbps)—The amount of bandwidth you allocated for the clean pipe instance.
      • Config Status—The status of your last configuration push to the service. If you have made a change locally, and not yet pushed the configuration to the cloud, the status shows Out of sync. Hover over the status indicator for more detailed information. After committing and pushing the configuration to Prisma Access, the Config Status changes to In sync.
      • BGP Status—Displays information about the BGP state between the firewall or router at the clean pipe instance and Prisma Access. Although you might temporarily see the status pass through the various BGP states (idle, active, open send, open pend, open confirm, most commonly, the BGP status shows:
        • Connect—The router at the clean pipe instance is trying to establish the BGP peer relationship with the cloud firewall.
        • Established—The BGP peer relationship has been established.
          This field will also show if the BGP connection is in an error state:
        • Warning—There has not been a BGP status update in more than eight minutes. This may indicate an outage on the firewall.
        • Error—The BGP status is unknown.
      • Status—The operational status of the connection between Prisma Access and the clean pipe instance.
      Statistics tab:
      • Region—The region where your cloud service infrastructure is deployed for the clean pipe instance.
      • Name—The name of the clean pipe instance.
      • Allocated Bandwidth (Mbps)—The amount of bandwidth you allocated for the remote network location.
      • QoS— Select QoS to display a page that contains graphical QoS statistics.
      • Avg Egress Bandwidth 5 Min (Mbps)—The average amount of clean pipe egress bandwidth averaged over 5 minutes.
      • Avg Egress Bandwidth 60 Min (Mbps)—The average amount of clean pipe egress bandwidth averaged over 60 minutes.
      • Avg Ingress Bandwidth 5 Min (Mbps)—The average amount of clean pipe ingress bandwidth averaged over 5 minutes.
      • Avg Ingress Bandwidth 60 Min (Mbps)—The average amount of clean pipe ingress bandwidth averaged over 60 minutes.
      • Egress Peak Bandwidth 1 Hour (Mbps)—The amount of peak egress bandwidth for the clean pipe instance for the last 1 hour.
      • Egress Peak Bandwidth 24 Hour (Mbps)—The amount of peak egress bandwidth for the clean pipe instance for the last 24 hours.
      • Egress Peak Bandwidth 7 Days (Mbps)—The amount of peak egress bandwidth for the clean pipe instance for the last 7 days.
      • Egress Peak Bandwidth 30 Days (Mbps)—The amount of peak egress bandwidth for the clean pipe instance for the last 30 days.
      • Ingress Peak Bandwidth 1 Hour (Mbps)—The amount of peak ingress bandwidth for the clean pipe instance for the last 1 hour.
      • Ingress Peak Bandwidth 24 Hour (Mbps)—The amount of peak ingress bandwidth for the clean pipe instance for the last 24 hours.
      • Ingress Peak Bandwidth 7 Days (Mbps)—The amount of peak ingress bandwidth for the clean pipe instance for the last 7 days.
      • Ingress Peak Bandwidth 30 Days (Mbps)—The amount of peak ingress bandwidth for the clean pipe instance for the last 30 days.

Technical Documentation

Company

Legal Notices

© 2025 Palo Alto Networks, Inc. All rights reserved.