: Activate SaaS Security Inline for NGFW
Focus
Focus

Activate SaaS Security Inline for NGFW

Table of Contents

Activate SaaS Security Inline for NGFW

Learn how to activate SaaS Security Inline on your Palo Alto Networks firewalls.
To unlock the SaaS Security Inline capabilities—SaaS visibility, SaaS policy rule recommendations, and App-ID Cloud Engine (ACE), simply activate SaaS Security Inline using one of the following activation types, depending on whether you have an Enterprise Level Activation (ELA) license type or non-ELA:
  • (
    non-ELA
    ) Activation email that you received.
  • (
    ELA
    ) Hub
    ELA Activations
    menu.
  • (
    ELA
    ) Customer Support Portal (CSP)
    Enterprise Agreements
    page.
If you are enabling SaaS Security Inline for Next-Generation CASB, activate in SASE Cloud Management Console using the activation email you received.
After activation, your firewalls contact the cloud service and begin to download any SaaS policy rule recommendations that you created.
SaaS Security Inline activation:
  • Creates a URL for SaaS Security Inline login.
  • Pushes the SaaS Security Inline license to the firewalls that you select. Panorama does not require a license.
  • Enables a secure and encrypted connection and successful, mutual authentication between SaaS Security Inline, Palo Alto Networks firewalls, Panorama, and
    Cortex Data Lake
    .
Before you activate:
  • Ensure that your environment meets all the activation requirements for the SaaS Security Inline features you want to enable. (
    SaaS administrator
    )
    Requirement
    SaaS Visibility
    SaaS Policy Recommendations and ACE
    One or more firewalls running PAN-OS 10.1 or later with or without Panorama.
    N/A
    Yes
    One new or existing
    Cortex Data Lake
    license per SaaS tenant.
    Yes
    Yes
    Same Support Account (CSP ID) for SaaS tenant,
    Cortex Data Lake
    , Enterprise DLP, and firewalls.
    Yes
    Yes
    One SaaS Security Inline license per firewall.
    Yes
    Yes
    Enterprise DLP license on NGFW and in the same CSP account as the SaaS tenant.
    Only required if you want to use the Data Profiles option for SaaS policy rule recommendations
    N/A
    Yes
    Because SaaS Security Inline requires network traffic data for analysis, you must enable firewalls to forward logs with that data to
    Cortex Data Lake
    . Your SaaS Security Inline subscription requires that you also have an active
    Cortex Data Lake
    instance, which stores the data logs from firewalls and streams them to SaaS Security Inline.
  • Start the ACE deployment. (
    Firewall administrator
    /
    SaaS Policy Rule Recommendations
    )
    ACE deployment is required if you want ACE and SaaS policy rule recommendations. ACE deployment is not required for displaying SaaS application visibility data, though you must still configure log forwarding. Without logs for
    all
    firewalls, SaaS Security Inline cannot display SaaS application visibility data and might not be able to enforce policy rule recommendations.
    • Bring the firewall and Panorama (if using) online.
    • Install the device certificate.
After you activate:
  • Complete your ACE deployment. (
    Firewall administrator
    /
    SaaS Policy Rule Recommendations
    )
    Again, ACE deployment is required if you want ACE and SaaS policy rule recommendations. ACE deployment is not required for displaying SaaS application visibility data.
    • Retrieve and verify SaaS Security Inline license, which the SaaS Security Inline activation pushed to your firewalls. Panorama doesn’t need a license. If you forget to do so, an error displays.
    • Configure service route for data services.
    • Create and verify connections to edge services and cloud service.
    • Enable ACE on Panorama (if using)
  • Configure log forwarding. (
    Firewall administrator
    /
    SaaS Visibility
    )
    You’re instructed to do so during your ACE deployment. If you only want SaaS visibility features, ACE deployment is optional, but log forwarding is required with or without ACE and SaaS policy rule recommendations enabled.
  1. Initiate the SaaS Security Inline activation process based on your license type.
    An ELA (Enterprise Level Activation) license activates all your firewalls. A non-ELA license activates a fixed numbers of firewalls.
    • (
      non‑ELA license
      ) Open your SaaS Security Inline activation email and click
      Activate
      , then log in with your Palo Alto Networks Customer Support Portal account credentials.
      The number of Activate buttons in the email you received depends on what you purchased. Each Activate button launches the same onboarding workflow that lets you activate all your purchased products together. Click any
      Activate
      button to begin. Additionally, your activation email depends on the type of activation: purchase, trial, or evaluation.
      It is important to keep the SaaS Security Inline activation email you received from Palo Alto Networks. In addition to containing confidential activation-related data, you will need this email to activate more firewalls later if you still have unused SaaS Security Inline licenses after completing the onboarding process.
    • (
      ELA license
      ) Log in to the hub with your Palo Alto Networks Customer Support Portal account credentials, then select
      SaaS Security
      from the
      ELA Activations
      menu on the hub.
    • Log on to Customer Support Portal (CSP) with Super User, Domain Administrator, and ELA Administrator permissions, then navigate to
      Assets
      >
      Enterprise Agreements
      and click
      ELA-SaaS Inline Activation
      .
  2. Select the products to activate, then
    Start Activation
    .
    If you have multiple items to activate, leave them all selected when you
    Start Activation
    .
  3. (
    non-ELA
    ) Select a
    Customer Support Account
    , then
    Next
    If you have more than one Support account, select the one with firewalls to subscribe to SaaS Security Inline.
    This step is not included in the ELA activation process because you begin the process in the Hub and, therefore, your Support account is already known.
  4. In
    SaaS Security Inline Setup
    , configure SaaS Security Inline.
    • Data Lake
      and
      Data Lake Region
      —You must have an active
      Cortex Data Lake
      or activate a new one now. Do one of the following:
      • New
        Cortex Data Lake
        —Select
        Activate New
        if you are activating a new
        Cortex Data Lake
        subscription, then choose its region.
      • Existing
        Cortex Data Lake
        —Select an existing
        Cortex Data Lake
        instance to use if you did not purchase a new
        Cortex Data Lake
        . If you have more than one
        Cortex Data Lake
        instance, choose the one to which firewalls will forward logs with network traffic metadata.
    • SaaS Tenant
      ,
      SaaS Region
      , and
      SaaS Subdomain
      —Do one of the following:
      • New Tenant
        —Select
        Activate New
        to create a new SaaS Security Inline tenant, then type a subdomain name, which completes the URL for your SaaS Security Inline app and becomes the URL where you log in to the SaaS Security web interface.
        SaaS Subdomain
        is prepopulated with the domain name from your email address, but you can change it if you want.
      • Existing Tenant
        —Select an existing tenant if you did not purchase a new
        Cortex Data Lake
        or you don’t want to activate a newly purchased
        Cortex Data Lake
        . Each SaaS tenant requires a unique
        Cortex Data Lake
        . You cannot reuse
        Cortex Data Lake
        s. The onboarding process enforces this requirement and automatically populates
        SaaS Tenant
        with the SaaS tenant that is mapped to the existing
        Cortex Data Lake
        .
        SaaS Region
        defaults to
        Cortex Data Lake
        region.
  5. Choose the
    Firewalls to enable for this SaaS Security Inline subscription
    , then
    Next
    .
    • (
      non-ELA
      ) Select a firewall
      Model
      on the left and then select subscriptions for the
      Serial Number
      (s) of individual device(s) belonging to that model on the right. Observe how many SaaS Security Inline subscriptions are assigned and still available for the selected model near the top of the page. Track the number of licenses each model will use and how many are still available in the middle of the page.
    • (
      ELA
      ) Select
      Serial Number
      column to select all firewalls up to 200. For each activation session, you can activate a maximum of 200 firewalls. To activate more, repeat the activation process.
    The following tables lists each firewall type that the SaaS Security Inline license types support:
    Firewall types
    SaaS Security Inline license types
    Prod
    Eval
    Trial
    Lab
    Prod (Production)
    Yes
    No
    Yes
    No
    Eval (Evaluation)
    No
    Yes
    No
    No
    Lab
    No
    No
    Yes
    Yes
    When you purchase SaaS Security Inline production subscriptions, the licenses are specific to firewall models. It’s not possible to use licenses created for one model with a different model. On the other hand, when evaluating SaaS Security Inline, Palo Alto Networks provides temporary eval and trial licenses that can be used on any firewall.
    A firewall type—prod, eval, and lab—is defined by the firewall SKU. To see the SKU for a firewall, log in to your Customer Support Portal account and navigate to
    Assets
    Devices
    and check the entry for the serial number of your firewall in the Model Name column. This is the SKU, which indicates the firewall type as follows:
    • prod SKU—ends with the firewall model name; for example, PAN-PA-200
    • eval SKU—ends with -E30, which stands for
      Eval + 30 days
      ; for example, PAN-PA-200-E30
    • lab SKU—ends with -LAB; for example, PAN-PA-200-LAB
  6. Verify your activation selections, read and agree to the terms and conditions, then
    Activate Subscription
    .
    (
    non‑ELA
    ) To check how many subscriptions will be used and how many remain, hover your cursor over the information icon next to
    Activate Subscriptions on
    <number>
    firewalls
    . A pop-up panel displays the total number of purchased SaaS Security Inline subscriptions you have, how many will be activated in this session, how many were previously activated, and how many have not yet been chosen for activation.
    Depending upon what you onboard, the activation process creates a URL for your SaaS Security web interface and applies SaaS Security Inline licenses to the selected firewalls and links them to your SaaS Security account. During ACE deployment, your firewall administrator retrieves the license keys from the license server.
  7. Verify that your
    Cortex Data Lake
    serial number displays on the web interface and indicates
    Monitoring
    .
  8. Navigate to
    Settings
    License Info
    , then verify your SaaS Security Inline license.

Recommended For You