Deploy Prisma Agent and Transition from GlobalProtect (Panorama)

1. Push the Prisma Agent configuration to Prisma Access if you have not done so already.

   In the Strata Cloud Manager, select Push ConfigPush. Confirm the Domain Name and User Authentication settings are in place before pushing; the commit will not complete if either is missing.
2. Download Installation Files

   1. In Strata Cloud Manager, select ConfigurationPrisma Access AgentEndpoint Management.

   2. Click Download Agent to download the Prisma Agent package and configuration file (config.json).

      The Prisma Agent installer reads the config.json file during startup, reads all the supported values in the file, and configures the agent accordingly.

      See Prisma Agent Deployment Configuration for more information on the configurable parameters in this file.

   3. Place both files in the same folder on your system for deployment.
3. Configure the Deployment Configuration File

   For a seamless migration, configure the following parameters in the config.json file:

   { "server_url": "your_prisma_accesse_agent_domain", "tenant_id": "your_tenant_id", "unload_gp": true }

   By default, GlobalProtect is not disabled upon installation of Prisma Agent (passive installation). The "unload_gp": true parameter disables GlobalProtect upon Prisma Agent installation (active installation).

   See Prisma Agent Deployment Configuration for more information on the configurable parameters in this file.
4. Allow List Prisma Agent Processes (Required)

   To ensure the uninterrupted operation of Prisma Agents on endpoints, configure antivirus, Endpoint Detection and Response (EDR), or firewall applications to recognize Prisma Agent processes as safe.

   For more information, see Prisma Agent Processes To Be Allow Listed on EDR Deployments.
5. Deploy the Agent to Endpoints

   For all endpoint platforms, the recommended best practice for Prisma Agent deployment is to install Prisma Agent in active mode, and once Prisma Agent is operational and working, uninstall GlobalProtect.

   Windows and macOS

   1. Use third-party mobile device management (MDM) software (Microsoft Intune, JAMF Pro) for large-scale deployments. See Deploy the Prisma Agent for more information. You can install Prisma Agent on endpoints with existing GlobalProtect installations.
   2. Use one of the following modes of installation:
      • Active Installation of Prisma Agent: Set the "unload_gp": true flag in the configuration file. This flag would ensure that the GlobalProtect App is disabled upon installation of Prisma Agent. The configuration should have the following values (Prisma Agent domain name, Tenant ID, and GlobalProtect disablement flag).

        {"server_url":"prisma_access_agent_domain_name","tenant_id":"your_tenant_id","unload_gp": true}

      • Passive Installation of Prisma Agent: Prisma Agent installation is passive by default, wherein, the agent installation does not disable GlobalProtect.
   3. For manual installation of Prisma Agent, run the installer with the configuration file present.

   Linux

   You can deploy Prisma Agent to a large number of Linux distribution endpoints using automated tools or endpoint management software (such as Fleet DM).

   1. Complete pre-installation tasks for Linux agents.
   2. GlobalProtect and Prisma Agent coexistence is not supported on Linux. Use the "unload_gp": true parameter in the config.json file to ensure that the GlobalProtect App is disabled upon install of Prisma Agent. The configuration should have the following values (Prisma Agent domain name, Tenant ID, and GlobalProtect disablement flag)

      {"server_url":"prisma_access_agent_domain_name","tenant_id":"your_tenant_id","unload_gp": true}

   3. Install the Prisma Agent for Linux.
   4. Uninstall GlobalProtect after Prisma Agent installation.

   Mobile (iOS & Android)

   1. You can deploy Prisma Agent to managed endpoints running Android and iOS devices using Microsoft Intune. See the following instructions:
      • Deploy Prisma Agents to Android Endpoints Using Microsoft Intune
      • Deploy Prisma Agents to iOS Endpoints Using Microsoft Intune
   2. For unmanaged endpoints running Android and iOS, see the following:
      • Download and install the agent for Android on unmanaged devices)
      • Download and install the agent for iOS on unmanaged devices
6. Verify Endpoint Certificate Requirements

   For Prisma Agents to successfully authenticate and enroll with Endpoint Manager, the endpoint must have the "Go Daddy Root Certificate Authority - G2" certificate as the trusted root certificate in the local machine store. If the certificate isn't present, enrollment fails.

   Physical endpoints running Windows or macOS are expected to be shipped with the Go Daddy Root Certificate Authority - G2 certificate. ESXi or cloud-based endpoints may need this certificate pushed out by administrators.

   To add to the Trusted Root Certificate list:

   1. Download the issuing certificate of the Endpoint Manager by accessing the Prisma Agent domain name in your browser.

   2. Select the Go Daddy Root Certificate Authority - G2 certificate and export it.

   3. Install the exported certificate in the trusted root certificate store (user store or local machine store).
      The following images show the installed Go Daddy Root certificate.
      Windows:
      macOS:

   4. With the certificate in place, Endpoint Manager enrollment will be successful after SAML authentication. The corresponding gateway connection will use the tokens provided by Endpoint Manager and provide a seamless experience for the end user.