>
    Strata Copilot
    Preinstall Tasks for Prisma Access Agents on Linux
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access Agent
    3. Prisma Access Agent User Guide
    4. Prisma Access Agent for Desktop Devices
    5. Preinstall Tasks for Prisma Access Agents on Linux
    Download PDF
    Prisma Access Agent

    Preinstall Tasks for Prisma Access Agents on Linux

    Table of Contents

    Preinstall Tasks for Prisma Access Agents on Linux

    Complete the relevant preinstall tasks before installing the Prisma Access Agent on Linux devices.
    Where Can I Use This?What Do I Need?
    • Prisma Access Agent
    • Minimum Prisma Access Agent version: 25.7
    • Linux devices
      Check the prerequisites for the supported Linux distributions
    • Internet access
    Before you begin to install Prisma Access Agent on Linux, complete the relevant preinstall tasks.

    Set Up the Prisma Access Agent System Tray Icon on Ubuntu 22.04

    If you're using Ubuntu 22.04, before you install the Prisma Access Agent, you need to set up the system tray icon functionality for Prisma Access Agent by installing the required GNOME extensions.
    Before you begin:
    • You need to be running Ubuntu 22.04 with the GNOME desktop environment
    • Ensure that you have administrator (sudo) privileges.
    • If you're running on a VM, you might need to disconnect GlobalProtect or Prisma Access Agent from the host system before proceeding.
    • Each user on the Linux system needs to complete this configuration individually. These settings apply per user account rather than system-wide.
    1. Remove any existing AppIndicator extension that might conflict by running the following command in the shell:
      sudo apt remove gnome-shell-extension-appindicator
    2. Install the GNOME Extension Manager to easily manage extensions:
      sudo apt install gnome-shell-extension-manager
    3. Apply the changes by logging out of the operating system and logging back in again.
    4. Install the AppIndicator Support extension.
      1. Open the Extension Manager application.
      2. Browse the extensions.
      3. Enter KStatus in the search bar.
      4. Locate AppIndicator and KStatusNotifierItem Support in the search results and Install the extension.
    5. Verify the installation of the AppIndicator Support extension.
      1. Go to the User-Installed Extensions section in Extension Manager.
      2. Confirm that AppIndicator and KStatusNotifierItem Support appears in the list of installed extensions and the extension is enabled (toggle is in the "on" position).
    6. Proceed with the Prisma Access Agent installation.
      Once the extension is successfully installed and verified, you can proceed to install the Prisma Access Agent. The system tray icon should now display properly.

    Set Up the Prisma Access Agent System Tray Icon on Fedora Linux (Wayland/GNOME)

    Before installing Prisma Access Agent on Fedora Linux systems running the default Wayland display server with the GNOME desktop environment, you need to set up the system tray icon functionality for Prisma Access Agent by installing the required GNOME extensions.
    This is a common issue since Wayland doesn't natively support the older system tray protocol that many applications, including Prisma Access Agent, still use. This task applies only to Prisma Access Agents running on Fedora ARM-based endpoints.
    Before you begin, ensure that you have:
    • Fedora Linux with the GNOME desktop environment
    • Wayland display server (default on modern Fedora installations)
    • Administrative (sudo) privileges
    1. Install the translation Layer (AppIndicator extension). This package provides the necessary translation layer to bridge legacy system tray applications with Wayland's security model.
      sudo dnf install gnome-shell-extension-appindicator
    2. Install management tools (optional but recommended). These tools provide a graphical interface for managing GNOME extensions and browser integration for extension management.
      sudo dnf install gnome-tweaks gnome-shell-extension-browser-connector
    3. Enable and validate.
      1. Restart your session by logging out and logging back in, or reboot the system to ensure the extension is loaded properly.
      2. Enable the extension:
        1. Open the GNOME Tweaks application.
        2. Navigate to the Extensions section.
        3. Locate AppIndicator and KStatusNotifierItem Support.
        4. Toggle the switch to ON if not already enabled.
      3. Proceed with the Prisma Access Agent installation.
      4. Verify the functionality by confirming the Prisma Access Agent system tray icon appears correctly in the GNOME top bar, providing access to the Prisma Access Agent app.

    Set Up the Prisma Access Agent System Tray Icon on Red Hat Enterprise Linux

    (Prisma Access Agent 26.2) Before you install the Prisma Access Agent on Red Hat Enterprise Linux (RHEL), you need to set up the system tray icon functionality for Prisma Access Agent by installing the required GNOME extensions.
    Before you begin, ensure that you have:
    • Any supported RHEL distribution running with the GNOME desktop environment
    • Administrator (sudo) privileges
    1. Enable the EPEL repository in the Terminal:
      sudo dnf install epel-release
    2. Install the GNOME Extension Manager to easily manage extensions:
      sudo dnf install gnome-shell-extension-appindicator
    3. Apply the changes by logging out of the operating system and logging back in again.
    4. Install the AppIndicator Support extension.
      1. Open the Extensions application.
      2. Search for the AppIndicator and KStatusNotifierItem Support extension.
      3. Enable the extension by toggling it on.
    5. Once the extension is successfully installed and verified, you can proceed to install the Prisma Access Agent.
    6. Verify the functionality by confirming the Prisma Access Agent system tray icon appears correctly in the GNOME top bar, providing access to the Prisma Access Agent app.

    Disable IPv6 on Linux Devices (Optional)

    Prisma Access Agent for Linux does not support IPv6 sinkholing. If your organization allows IPv6 traffic, you'll need to disable IPv6 on your device before installing the agent to minimize your exposure from IPv6-based threats.
    1. Disable IPv6 at the system level using any available methods such as GRUB.
      1. Edit the GRUB configuration file:
        sudo nano /etc/default/grub
      2. Add or modify the GRUB_CMDLINE_LINUX parameter to include ipv6.disable=1:
        GRUB_CMDLINE_LINUX="quiet splash ipv6.disable=1"
      3. Update the GRUB configuration:
        • For Ubuntu: 
          sudo update-grub
        • For Arch Linux or Fedora: 
          sudo grub-mkconfig -o /boot/grub/grub.cfg
      4. Reboot the system:
        sudo reboot
      5. Verify that IPv6 is disabled:
        cat /proc/sys/net/ipv6/conf/all/disable_ipv6
        The command should return 1 if IPv6 is successfully disabled.
    2. The Mozilla Firefox browser also requires disabling IPv6 for DNS queries. To disable DNS over HTTPS (DoH) in Firefox:
      1. Open Firefox and enter about:config in the address bar.
      2. Search for network.dns.disableIPv6.
      3. Set the value to true.

    Prepare Your NixOS System for Prisma Access Agent Installation

    (Prisma Access Agent 26.2) NixOS support for Prisma Access Agent integrates the agent's security capabilities directly into your declarative NixOS environment. NixOS operates declaratively through your /etc/nixos/configuration.nix file, which nixos-rebuild processes.
    The installation of Prisma Access Agent version 26.2 or later in your NixOS environment requires nftables to be enabled and the necessary CA certificates configured in your configuration.nix file for the agent's operation.
    Complete the following steps so that your system has the necessary services, packages, and certificates before agent installation, aligning with NixOS's immutable system design.
    1. In NixOS, access your NixOS configuration file:
      sudo vim /etc/nixos/configuration.nix
      The default editor for NixOS is Nano. This example uses the Vim editor. You can also use other supported editors of your choice, such as Emacs.
    2. Enable nftables by adding the following statement to your NixOS configuration file:
      networking.nftables.enable = true;
    3. Add the required system packages to your NixOS configuration:
      environment.systemPackages = with pkgs; [
  vim
  wget
  nftables
];
    4. (Optional) Enable the SSH service in your configuration.nix file.
      services.openssh.enable = true;
    5. Configure trusted CA certificates for Prisma Access Agent:
      security.pki.trusted.pem = [
  "/path/to/your/ca.pem" # Replace with the actual path to your CA certificate
];
      The following sample image shows the necessary additions to the /etc/nixos/configuration.nix file, including enabling nftables and adding required packages.
    6. Rebuild your NixOS system to apply the changes:
      sudo nixos-rebuild switch

    © 2026 Palo Alto Networks, Inc. All rights reserved.