>
    Your Prisma Access Agent License for NGFW Deployments
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access Agent
    3. Prisma Access Agent Administration
    4. License and Activation
    5. NGFW Support for Prisma Access Agent
    6. Your Prisma Access Agent License for NGFW Deployments
    Download PDF
    Prisma Access Agent

    Your Prisma Access Agent License for NGFW Deployments

    Table of Contents

    Your Prisma Access Agent License for NGFW Deployments

    Understand the licensing features for Prisma Access Agent for NGFW deployments.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by Panorama)
    • Check the prerequisites for the supported PAN-OS versions
    • Prisma Access Agent license for NGFW deployments
    Prisma Access Agent, a next-generation mobile access agent from Palo Alto Networks, offers enhanced security, performance, and manageability for remote access users. It enables you to remotely troubleshoot endpoint issues and collect agent logs and additional data such as OS and endpoint events without intervention from end users. Prisma Access Agent provides in-product user-group based agent upgrades with rollback functionality, enabling gradual upgrades while maintaining business continuity. To aid in gradual adoption, Prisma Access Agent can coexist with existing GlobalProtect™ deployments in your current setup.
    Review the following licensing options and requirements to help you effectively deploy and manage Prisma Access Agent on your NGFW systems, ensuring integration with your existing infrastructure and adherence to licensing terms.

    Licensing Options

    You can obtain Prisma Access Agent for your NGFW deployments through three main options:
    • Platform-specific SKUs for NGFW deployments, which follow a structure similar to GlobalProtect using the format PAN--PAA, such as PAN-<PA-1420>-PAA. These are available for various NGFW platforms and support one-, three-, and five-year subscription terms.
      You can also get high availability pair SKUs in the format PAN--PAA-HA2.
    • Existing Enterprise License Agreement (ELA) SKU, PAN-ENT-ELA-SUB, which includes Prisma Access Agent licenses without additional cost.
    • VM-Flex credits (Software NGFW credits)

    License Activation and Management

    To activate Prisma Access Agent, you need to install the license on your NGFW firewall. This will replace any existing GlobalProtect licenses. You will notice the licensing page updates, with the heading changing from GlobalProtect Gateway to Gateway, and the description updating to Gateway License for Prisma Access Agent.
    In older versions of PAN-OS, only the description gets updated to Gateway License for Prisma Access Agent.

    Key Licensing Requirements and Considerations

    The Prisma Access Agent license entitles you to use the GlobalProtect app and Prisma Access Agent and replaces the former GlobalProtect Gateway License. The Prisma Access Agent license lets you connect from both the GlobalProtect app and Prisma Access Agent. Your maximum number of supported sessions is determined by your hardware model's platform limit.
    For high availability deployments, you must install identical licenses on both devices. You can use the new license on older PAN-OS releases, ensuring compatibility with your existing infrastructure.

    Evaluation and Expiration

    You can evaluate Prisma Access Agent for up to 90 days, with the possibility of extension if needed. You're allowed to evaluate it on NGFWs with existing GlobalProtect subscriptions.

    Additional Licensing Details

    Your LAB and NFR licenses include the Prisma Access Agent license. You can get renewal SKUs in the format PAN--PAA-R, such as PAN-<PA-1420>-PAA-R. When you purchase a Prisma Access Agent or ELA SKU, you also get Strata Cloud Manager Essentials. If you need additional support, you can obtain a Customer Success & Professional Service SKU (PAN-CONSULT-NGFW-QS-PAA-REMOTEACCESS).

    © 2025 Palo Alto Networks, Inc. All rights reserved.