Configure Dynamic Autoscaling for a GCP Manual Deployment

Where Can I Use This?	What Do I Need?
Prisma AIRS GCP	Prisma AIRS license Access to Strata Cloud Manager A GCP project connected to Strata Cloud Manager Terraform CLI installed and authenticated to your GCP security project Valid AIRS firewall Auth Code and SSH key pair

GCP supports autoscaling for manually deployed non-mesh AIRS firewalls. In this workflow, you download a Terraform template generated by Strata Cloud Manager and run terraform apply directly in your GCP security project. This gives you full control of the deployment lifecycle while still using Strata Cloud Manager to generate the autoscaling configuration.

Deployments that belong to different cloud providers must use separate cloud-specific folders in Strata Cloud Manager. Use a separate, unique folder per deployment to prevent configurations from previous deployments — including namespace/instrumentation key and update interval settings — from being overridden.

1. In Strata Cloud Manager, go to InsightsDiscover & AssessDeployAdd New Deployment.
2. On the Firewall Deployments page, select GCP as your cloud provider, then select your Subscription/Project and Region.
3. Select Download Terraform templates and execute on my own.

4. Fill in all firewall configuration parameters, including Min/Max Instances, Update Interval, and autoscaling metrics.
5. Enter a Terraform Template Name and click Create Template.

   If the folder was previously used for another deployment, you may see an "Object already exists" error at this step. See Override Folder Configuration to resolve it.
6. Download the generated Terraform template.
7. In the GCP Console, go to your security project and run terraform apply.
8. Verify the deployment in the GCP Console: confirm that security infrastructure is created (firewalls, MIG, security VPCs — trust, untrust, and management).
9. Navigate to VM Instances in the GCP Console and confirm your firewall instances are running.
10. In Strata Cloud Manager, ensure the GCP_VM_DEFAULT snippet is associated with your target folder.
11. Verify snippet variables: confirm Trust Subnet Gateway address and Frontend ILB address values are correctly populated, along with all other required variable values.
12. Perform a folder push from Strata Cloud Manager to apply the configuration to the folder.
13. Execute manual route stitching to complete the network setup.
14. Verify that the firewall instances appear in Strata Cloud ManagerDevice Management and confirm that the serial numbers are licensed in the customer support portal.

Override Folder Configuration to Resolve "Object Already Exists" Error

Resolve the PRISMA_ACCESS_API_I00013 Object already exists error that appears when a GCP manual deployment uses a folder that already has autoscaling configuration applied.

If multiple GCP manual deployments share the same Strata Cloud Manager folder, the POST /config/device/v1/autoscale API call fails with the following error at the configuration review step:

{
    "_errors": [
        {
            "code": "PRISMA_ACCESS_API_I00013",
            "message": "Object already exists - /config/devices/entry[@name='localhost.localdomain']/container/entry[@name='<folder-name>']/devices/entry[@name='localhost.localdomain']/deviceconfig/virtualization",
            "details": null
        }
    ],
    "_request_id": "9159994e-750e-4eb7-b456-7a7e040a2aff"
}

The recommended fix is to use a unique folder per deployment. If you cannot change the folder structure, override the existing folder configuration using the following procedure.

Previous deployments in the same folder will also be overridden with the latest configuration. Use a separate, unique folder per deployment whenever possible.

1. In Strata Cloud Manager, go to ConfigurationNGFW & Prisma Access.
2. Select the folder you want to override in the configuration scope.

3. Go to Network & DevicesDevice Setup.
4. Edit the configuration in the VM-Series plugin section.

5. Update the settings as required — for example, change the Update Interval or verify the Publish metrics to Stackdriver setting.

6. Perform a folder push to apply your updated settings to the folder.

The folder configuration is overridden with the new autoscaling settings. You can now retry the GCP manual deployment without the "Object already exists" error.