Prisma Access offers a licensing model that allows you
to implement and use the capabilities of Prisma Access aligned to
your business needs in a way that delivers the fastest return on
investment. Whether your applications are migrating to the cloud,
your users are working from anywhere, or if you are looking to gain
operational efficiencies, Prisma Access offers the relevant type
of license for your deployment.
You can choose from the following license editions:
Business
Business Premium
Zero Trust Network Access (ZTNA) Secure Internet Gateway
(SIG)
Enterprise
Your Prisma Access license edition determines the security
capabilities you are allowed to use. If you use any capability in
security rules or profiles that is unsupported based on your license
type, Prisma Access removes those configurations and those capabilities
are not enforced in your Prisma Access tenants until you update
Prisma Access with a license edition that supports those capabilities.
To find the capabilities included with your license, refer to the Prisma Access Licensing Guide.
All license editions are available for Local and Worldwide Prisma
Access locations. When you purchase a license with Worldwide locations,
you can deploy Prisma Access in all Prisma Access locations. When
you purchase a license with Local locations, you can select up to
5 Prisma Access locations.
Prisma Access uses
units
in licenses, and uses the following
definitions for a unit:
For mobile user deployments, a
unit
is defined
as one mobile user.
For remote network and Clean Pipe deployments, a
unit
is
defined as 1 Mbps of bandwidth.
When a Prisma Access license expires, you can still use
the service and collect logs for 15 days after license expiration.
You cannot make changes to configuration. Prisma Access shuts down
its instances 15 days after license expiration and completely deletes
the instances and tenants 30 days after license expiration.
License Enforcement for Mobile User Deployments
Prisma Access uses these enforcement policies for mobile
user licenses:
Though there is no strict policing of the mobile user
count, the service does track the number of unique users over the
last 90 days to ensure that you have purchased the proper license
tier for your user base, and stricter policing of user count may
be enforced if continued overages occur.
In addition, if you use Prisma Access for users—GlobalProtect,
the GlobalProtect app is required on each supported endpoint. The
GlobalProtect app is not required for Mobile Users—Explicit Proxy
deployments.
Explicit Proxy Licensing Guidelines
Use the following information when you license and assign
mobile user units to your Explicit Proxy deployment:
Prisma Access Explicit Proxy requires that you have a
Prisma Access license for Mobile Users.
You can use mobile user units for either Prisma Access Explicit
Proxy or Prisma Access GlobalProtect deployments.
If
your deployment is Explicit Proxy only, then allocate all the mobile
user units to Explicit Proxy. Similarly, if your deployment is completely
GlobalProtect, then allocate all the mobile user units to GlobalProtect.
You must allocate a minimum of 200 units per deployment type.
If your deployment requires some users to connect using Explicit
Proxy and others using GlobalProtect; then split and allocate the
mobile user units between Explicit Proxy and GlobalProtect. You
can switch the number of units allocated for Explicit Proxy and
GlobalProtect at any time, giving you the flexibility to transition
from Explicit Proxy to GlobalProtect any time.
If you want to use both GlobalProtect and Explicit Proxy
for the same user, you must allocate one unit each for Explicit
Proxy and GlobalProtect.
Other Required Licenses
In addition to the Prisma Access licenses, in order
to run the service you must also have the following licensed components:
Panorama
—You deploy and manage Prisma Access using
the Cloud Services plugin for Panorama. In order to use this plugin, you
must have Panorama with a valid support license. See the Palo Alto Networks Compatibility
Matrix for the Panorama versions that are supported with
the Cloud Services plugin. When you license the Prisma Access components,
you must tie the auth code to a licensed Panorama serial number.
Cortex Data Lake
—The Prisma Access infrastructure
forwards all logs to Cortex Data Lake. You can view the Prisma Access
logs, ACC, and reports directly from Panorama for an aggregated
view into your remote network and mobile user traffic. To enable
logging for Prisma Access, you must purchase a Cortex Data Lake
license.
Add-On Licenses
You can add the following capabilities to use with Prisma
Access as an add-on license:
Some license requirements, such as the requirements
you need to enable tenants
in a multitenant configuration, are dependent on the type
of Prisma Access license you have. To determine your license type,
select
Panorama
Licenses
and
find the information in the
Prisma Access
area.
Licenses available after November 17, 2020 include the license
Edition
and
provide you with the type of
Prisma Access Locations
you
can deploy (either
Local
or
Worldwide
locations).
Licenses available before November 17, 2020, contain the words
GlobalProtect
Cloud Service
in the license areas and are divided by
remote networks, mobile users, or Clean Pipe.