Activate and Install GlobalProtect Cloud Service

Use the following workflow to license the GlobalProtect cloud service and download and install the Cloud Services plugin:
To set up the GlobalProtect cloud service in High Availability (HA) mode with a primary and secondary Panorama, Configure Panorama Appliances in High Availability for GlobalProtect Cloud Service and Cortex Data Lake before you license and activate the GlobalProtect cloud service.
  1. Activate the GlobalProtect cloud service auth codes for the GlobalProtect cloud service components you purchased (GlobalProtect cloud service for remote networks and/or GlobalProtect cloud service for mobile users):
    You must activate your Cortex Data Lake auth code before activating the GlobalProtect cloud service auth codes.
    1. Log in to the Customer Support Portal (CSP) and select AssetsCloud ServicesActivate Cloud Services Auth-Code.
      activate-cloud-services-auth-code.png
    2. To license the GlobalProtect cloud service for remote networks (if applicable), enter the Authorization code you received in the email, select the Panorama Serial Number for the Panorama on which you plan to install the Cloud Services plugin, and then Agree and Submit the EULA.
      After you see the registration complete message, close the Cloud Services dialog.
    3. To license the GlobalProtect cloud service for mobile users (if applicable), click Activate Cloud Services Auth-Code, enter the Authorization Code you received in the email, select the serial number for the Panorama on which you plan to install the Cloud Services plugin, read the End User License Agreement and Support Agreement and then Agree and Submit.
      activate-gpcs-auth-code.png
      After you see the registration complete message, close the Cloud Services dialog.
  2. Verify the Quantity and Part Description of the GlobalProtect cloud service licenses you just activated.
    csp-verify-purchase.png
  3. Download and install the Cloud Services plugin:
    The way you download and install the plugin depends on whether you are using Panorama version 8.0.5 or later or 8.1.0 or later (including 9.0.0 or later).
    Panorama appliances running 8.1.2 are not supported because of a Cortex Data Lake issue. See Cortex Data Lake Known Issues for details.
    While using Panorama 9.0 is supported with GlobalProtect cloud service, upgrading to Panorama 9.0 does not give you access to 9.0 features in GlobalProtect cloud service. The GlobalProtect cloud service infrastructure supports PAN-OS features up to release 8.1.
    On Panorama 8.0.x:
    1. Log in to the Customer Support Portal and select UpdatesSoftware Updates.
    2. Find the Cloud Services plugin version 1.3.1 in the Panorama Integration Plug In section and download it to your local system. Any other plugin versions are not supported.
      csp-plugin-download-1-3-1.png
      Do not rename the plugin file or you will not be able to install it on Panorama.
    3. To install the plugin, log in to the Panorama Web Interface of the Panorama you selected when you licensed the GlobalProtect cloud service, select PanoramaPluginsUpload and Browse for the plugin File that you downloaded from the CSP.
    4. Install the plugin.
    On Panorama 8.1.0 and later:
    On Panorama 8.1.0 or later, you can either download the plugin from the CSP and then upload it to Panorama, or you can check for plugin updates directly from Panorama as follows:
    1. Select PanoramaPlugins and click Check Now to display the latest cloud_services plugin updates.
      plugin-updates-1-3-1.png
    2. Download plugin version 1.3.1.
      Any other plugin versions are not supported.
    3. After downloading the plugin, Install it.
    Installing a newer version of the Cloud Services plugin overwrites the previously installed version. If you are installing the plugin for the first time, after you successfully install, Panorama refreshes and the Cloud Services menu displays on the Panorama tab.
    plugin-installed.png
  4. Retrieve the GlobalProtect cloud service license(s).
    1. Select PanoramaLicenses and click Retrieve license keys from license server.
    2. Verify that you have the licenses for the GlobalProtect cloud service components you plan to use.
      gpcs-license.png
  5. Verify your account. You must be a super user on the Customer Support Portal (CSP) to generate the one-time password required to verify your account.
    When you try to use the Cloud Services plugin for the first time after installing it, you will be prompted to verify your account. This step ensures that the Panorama serial number is registered to use the GlobalProtect cloud service and enables a secure communication path between the GlobalProtect cloud service components and Panorama.
    1. Log in to the Palo Alto Networks Customer Support Portal (CSP) as a super user and select AssetsCloud Services.
    2. Click Generate OTP.
      csp-otp.PNG
    3. Select the serial number for the Panorama where you installed the Cloud Services plugin and click Generate OTP.
    4. Click Copy to Clipboard.
    5. Go back to Panorama and click PanoramaCloud ServicesConfiguration and click Verify.
      If Verify is disabled, check that you have configured a DNS server and NTP server on PanoramaSetupServices.
      gpcs-verify-screen.png
    6. Paste the One-time Password you just generated and click OK.
      verify-account.png
      You have ten minutes to enter the OTP before it expires.
      After successful verification of the GlobalProtect cloud service you can Enable the Service Infrastructure.

Related Documentation