Install the Prisma Agent on Linux

1. (All supported Linux distributions except NixOS) Download and install the Prisma Agent:

   1. Download the Prisma Agent package from your designated download location (provided by your administrator). The package name is in the following format:

      PrismaAccessAgent_<architecture>_<version>.AppImage

      Where:

      • <architecture> identifies the platform architecture (x86_64 or arm64)
      • <version> identifies the current version number of the Prisma Agent AppImage
   2. Set the appropriate execute permissions to the Prisma Agent package. For example, for Prisma Agent version 25.7.0.10 on x86_64, enter the following command:

      sudo chmod 755 ./PrismaAccessAgent_x86_64_25.7.0.10.AppImage

   3. When running any AppImage, it mounts itself to a temporary directory under /tmp/<directory_name>. Therefore, ensure that:

      • The /tmp directory has executable permissions for both user and root accounts
      • Users have read and executable permissions for all files within the /opt/paloaltonetworks/prismaaccessagent directory tree
   4. (Prisma Agent 26.3 and later) Install the Prisma Agent from the command line based on your environment.

      Desktop (interactive session) — Run the AppImage directly as your user. The installer prompts you for your sudo password when it needs elevated privileges, and the agent UI launches automatically after installation completes.

      ./PrismaAccessAgent_<architecture>_<version>.AppImage --install

      Sample output:

      Running PrismaAccessAgent Installer…
      [sudo] password for <username>:

      Remote (SSH or RDP) — Run the AppImage. The agent UI won't launch automatically because the user environment isn't preserved. After installation completes, start the agent UI from the Applications menu in your next desktop session.

      ./PrismaAccessAgent_<architecture>_<version>.AppImage --install

      The installer displays the following warning when it can't start the UI:

      WARNING:
      User environment not preserved to start PrismaAccessAgent UI application...
      You can start the PrismaAccessAgent UI application from the System's Applications menu.
      PrismaAccessAgent UI application also will be auto-started after desktop user logout/login.
      PrismaAccessAgent installation finished.

   5. (Prisma Agent 26.2 and earlier) Install the Prisma Agent from the command line.

      sudo -E ./PrismaAccessAgent_<architecture>_<version>.AppImage -i

      The following sample image shows the terminal output showing the successful completion of the agent installation on Ubuntu:

      (Prisma Agent 26.2) During installation, the agent detects your desktop environment and installs only the system tray dependencies your environment requires:

      • Gnome — The installer checks for the gnome-shell-extension-appindicator extension and installs it if it is not already present.
      • KDE — The agent uses the native KStatusNotifierItem protocol to render the system tray icon. No additional packages are installed.
      • Other desktop environments — The installer proceeds without installing any UI dependencies and displays the following warning:

        [WARNING] Unsupported Desktop Environment Detected: <desktop_environment_name>
        The Prisma Access Agent is optimized for Gnome and KDE.
        On your current environment, the system tray icon and UI pop-ups may not render correctly.
        The background agent services will still function as expected.
        Do you wish to proceed with the installation? [y/N]:

2. (NixOS) (Prisma Agent 26.2) Download and install the Prisma Agent package for NixOS. In addition to the Prisma Agent AppImage, NixOS requires a separate installer archive (.tar.gz), which contains the NixOS-specific configuration and installer script.

   Prisma Agent integrates with NixOS by defining the AppImage as a custom app package. This process uses the paa_nixos_configuration.nix file and paa_nixos_installer.sh script for system management. The paa_nixos_configuration.nix file declares how NixOS imports the AppImage into its store, defines the PASrv executable as a Systemd service, and integrates the PAGui UI application.

   1. Download the Prisma Agent AppImage and NixOS installer archive to the same folder on your computer:

      • PrismaAccessAgent_<architecture>_<version>.AppImage
      • paa_nixos_installer_<version>.tar.gz
   2. Go to the folder containing the installer archive and AppImage and extract the installer archive:

      tar -zxvf paa_nixos_installer_<version>.tar.gz

      After extraction, your folder should contain the following files:

      • PrismaAccessAgent_<architecture>_<version>.AppImage
      • paa_nixos_installer.sh
      • paa_nixos_configuration.nix
   3. Install the Prisma Agent using the dedicated NixOS installer script, which integrates the agent declaratively into your system, treating it as a custom package.

      1. Run the NixOS installer script with the install option as a user.

         ./paa_nixos_installer.sh --install

         The script displays installation messages, including steps such as "creating config directories," "copying app image," and "adding PA configuration to the NixOS configuration."
         The installer script will show the following message and prompt the user to enter their sudo user password:

         PrismaAccessAgent for NixOS
         [sudo] password for <username>
         

         The following sample image shows the terminal output showing the successful completion of the NixOS installer script:

      2. Log out and log back into your desktop session. After login, the Prisma Agent system tray icon will be visible on your desktop.
3. (Ubuntu 22 on ARM64) For Prisma Agent to function properly on a VM, complete the following steps:

   1. Edit the 50-cloud.init.yaml file:

      sudo nano /etc/netplan/50-cloud-init.yaml

   2. In the YAML file, insert the renderer: NetworkManager statement in the network field and save your changes. For example:

      network:
           ethernets:
                ens160:
                     dhcp4: true
           version: 2
           renderer: NetworkManager

   3. To have the YAML changes persist across an instance reboot, create the /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg file with the following content:

      network: {config: disabled}

   4. Apply the change:

      sudo netplan apply

   5. Restart the network manager service:

      sudo systemctl restart NetworkManager.service

4. (Ubuntu 22.04) Perform a system reboot.
5. Log in to the Prisma Agent to complete your initial enrollment.

   After installation, the agent does not automatically connect to Prisma Access, even if your administrator configured Always On mode. You must log in for the first time to complete enrollment. After this first login, Always On mode takes effect and the agent connects automatically on subsequent logins. For instructions, see Log in to the Prisma Agent.