Prisma Access
Activate Your Prisma Access License (Panorama)
Table of Contents
Expand All
|
Collapse All
Prisma Access Docs
-
- Prisma Access China
- 4.0 & Later
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
-
-
-
- 5.2 Preferred and Innovation
- 5.1 Preferred and Innovation
- 5.0 Preferred and Innovation
- 4.2 Preferred
- 4.1 Preferred
- 4.0 Preferred
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
Activate Your Prisma Access License (Panorama)
Prisma Access
License (Panorama
) If you have a new
Prisma Access (Managed by Panorama)
Access deployment as of August 2022, use Prisma Access (Managed by Panorama)
and Subscription Management to
activate licenses and manage subscriptions. Be sure to follow the planning checklist before
you begin activation.If you have already activated your deployment
and you need to upgrade your Cloud Services plugin to a new version,
use the workflow in the Prisma Access Release Notes (Panorama
Managed).
If you have an existing Panorama Managed
Prisma Access
deployment, Palo Alto Networks sends you a notification
about the transition of your Prisma Access
license activation to
the Prisma SASE Platform. After the transition, you can only use
the Prisma SASE Platform for License Activation
.
You cannot use the other Common Services
such
as Tenant Management
or Identity
& Access
. Continue to manage your tenants and user
role permissions on Panorama as you have been doing.Prisma
Access does not support FIPS-CC mode.
Planning Checklist Before You Activate Prisma Access
Prisma Access
If
you are deploying
Prisma Access
for the first time, make sure that
you have the following information and resources:- Be sure that you have the order fulfillment email that contains the activation links that are required to activatePrisma Access.
- If you will use an existing Panorama to managePrisma Access, be sure you that the Panorama on which you will install the Cloud Services plugin (which activatesPrisma Access) is running the minimum Panorama version.During product activation, you can select an existing Panorama to managePrisma Access, if you have registered Panorama, installed the licenses, and activated the support license on the Customer Support Portal (CSP). If you have added the Panorama serial number to the same CSP account on which you want to deployPrisma Access, you can select the serial number of this Panorama appliance during installation.Alternatively, if you have a licensed Panorama that you have not yet installed, you can select that Panorama during product activation; the installation process provides you with links to register and install Panorama. In either case, the activation process allows the Panorama appliance you select to managePrisma Access, and you must make sure that the Panorama appliance is running the minimum software version.For a list of the Panorama software versions that are supported withPrisma Access, see Minimum Required Panorama Software Versions in the Palo Alto Networks Compatibility Matrix.Make a note of the serial number of the Panorama appliance; you use that serial number in a later step.
- Be sure that you have configured a DNS server and NTP server on the Panorama that managesPrisma Access(). If you do not configure a DNS and NTP server, you cannot verify your account and will have to reinstall the plugin.PanoramaSetupServices
- DuringPrisma Accessinstallation, Palo Alto Networks provides you the required roles on the Hub to activate Prisma Access, if those Hub roles are not already present. After you complete installation, you are assigned a role of Instance Admin. If you need additional roles on the Hub to perform system tasks, log in to the Hub, select, find theSettingsAccess ManagementAccount Administratorfor your organization, and contact them to be assigned additional roles.
- (Deployments Using Panorama Appliances in HA Mode Only) If you plan to use two Panorama appliances in High Availability (HA) mode, to simplify the HA set up, you should configure the Panorama appliances in HAafteryou purchasePrisma AccessandStrata Logging Serviceauth codes and components and associate the serial number of the primary Panorama appliance on which you plan to install the Cloud Services plugin with the auth codes, butbeforeyou activate and install Panorama Managed Prisma Access. However, you can use the same configuration process for Panorama appliances that already have the plugin installed.
License Activation
Complete the following steps to activate your
Prisma Access
licenses and download and install the Cloud Services plugin.- When you receive the activation email from Palo Alto Networks, selectGet Started with Prisma SASEand begin the activation process.
- When setup is complete, copy the one-time password (OTP). You use this when you verify your account on Panorama.
- Download and install the Cloud Services plugin.See the Palo Alto Networks Compatibility Matrix for the Panorama versions that are supported with the Cloud Services plugin.You can either download the plugin from the Customer Support Portal, or you can check for plugin updates directly from Panorama.
- To download and install the Cloud Services plugin by downloading it from the Customer Support Portal, complete the following steps.
- Log in to the Customer Support Portal and select.Software UpdatesPanorama Integration Plug In
- Find the Cloud Services plugin in the Panorama Integration Plug In section and download it.Do not rename the plugin file or you will not be able to install it on Panorama.
- Log in to the Panorama Web Interface of the Panorama you licensed for use with thePrisma Access, selectandPanoramaPluginsUploadBrowsefor the pluginFilethat you downloaded from the CSP.
- Installthe plugin.
- To download and install the Cloud Services plugin directly from Panorama, complete the following steps:
- Selectand clickPanoramaPluginsCheck Nowto display the latest Cloud Services plugin updates.
- Downloadthe plugin version you want to install.
- After downloading the plugin,Installit.
Installing a newer version of the Cloud Services plugin overwrites the previously installed version. If you are installing the plugin for the first time, after you successfully install, Panorama refreshes and the Cloud Services menu displays on thePanoramatab. - Retrieve thePrisma Accesslicense(s).
- Selectand clickPanoramaLicensesRetrieve license keys from license server.
- Verify that you have the licenses for thePrisma Accesscomponents you plan to use.
- When you try to use the Cloud Services plugin for the first time after installing it, you will be prompted to verify your account. This step ensures that the Panorama serial number is registered to use Prisma Access and enables a secure communication path between thePrisma Accesscomponents and Panorama.
- In Panorama, selectand clickPanoramaCloud ServicesConfigurationVerify.IfVerifyis disabled, check that you have configured a DNS server and NTP server on.PanoramaSetupServices
- Paste theOne-time Passwordyou copied and clickOK.You have ten minutes to enter the OTP before it expires.
- Apply device group changes in thePrisma Accessinfrastructure.Prisma Accessmoves all device groups under theSharedhierarchy. This step applies the device group changes to your configuration.
- Select.PanoramaCloud ServicesConfigurationService Setup
- Click the gear icon to edit theSettings.
- Make sure thatService_Conn_Device_Groupis selected as theDevice Group NameandSharedis selected as theParent Device Group.
- ClickOK.Do not clickCancel, even if you did not make any changes to this page.
- Continue to configure yourPrisma Accessdeployment by Enabling the Service Infrastructure.