Get Started with Prisma Access Agent for Panorama Managed Deployments

1. Enable the Prisma Access Agent.

   1. If you don’t already have Strata Cloud Manager, enable it for managing Prisma Access Agent configurations:

      Follow the instructions in NGFW Support for Prisma Access Agent.
   2. Contact your Palo Alto Networks account representative to activate the Prisma Access Agent feature.
2. Configure the infrastructure settings.

   1. Launch the Prisma Access Agent configuration interface.

      • For Panorama Managed Prisma Access deployments:
        1. From Panorama, selecting PanoramaCloud ServicesPrisma Access AgentLaunch Prisma Access Agent.

        2. Navigate to the Prisma Access Agent Setup page by selecting WorkflowsPrisma Access AgentSetup.
      • For Panorama Managed NGFW deployments:
        1. Log in to Strata Cloud Manager as the administrator.
        2. Navigate to the Prisma Access Agent Setup page by selecting WorkflowsPrisma Access AgentSetup.
   2. Configure the Prisma Access Agent Domain Name (also known as the EPM FQDN) as specified here:

      Set Up the Infrastructure for Prisma Access Agents
   3. Configure the following settings in Panorama:

      • Prisma Access Locations
      • Gateways
      • Client DNS
      • Client IP Pool

      These configuration appears as read-only in the Prisma Access Agent configuration interface.

3. Configure user authentication so that only legitimate Prisma Access Agent users have access to your services and applications.

   Set up Prisma Access Agent User Authentication
4. Configure Prisma Access Agent components.

   1. Agent Settings: Configure basic agent parameters using Set Up the Prisma Access Agent.
   2. Gateways: Set up gateway configurations following Configure Gateways for the Prisma Access Agent.
   3. Staged Rollouts: Configure agent upgrade phases using Staged Rollouts for Prisma Access Agents.
   4. Global Settings: Configure application-wide settings using Configure General Global Settings for the Prisma Access Agent.

      For external or NGFW gateways, enable the Authentication Override Cookie and ensure the same certificate is used across all gateways using Configure a Certificate to Decrypt the Authentication Override Cookie.
   5. Forwarding Profiles: Set up traffic management using Set Up Forwarding Profiles to Manage Agent Traffic.
5. Deploy and validate the agent.

   1. Download the Agent Package: Get the installation package using Download the Prisma Access Agent Package.
   2. Install the Agent: Deploy the agent on client devices using Install the Prisma Access Agent or Deploy the Prisma Access Agent using MDM software.
   3. Verify Functionality: Test agent connectivity and functionality using one of the following methods:

      • Prisma Access Agent for Desktop Devices.
      • Check the status of the agent, EPM, and tunnel using the Prisma Access Agent commands (PACli).