Enable Multitenancy and Create a Tenant

1. Install and activate Prisma Access for Clean Pipe.
   Prisma Access for Clean Pipe requires a separate license, and activating it creates Clean Pipe-specific tabs in the Cloud Services plugin. The procedure you use to install Prisma Access for Clean Pipe is the same as the procedure you use to activate and install a standard Prisma Access license, including installing the Cloud Services plugin.
2. Enable multitenancy if you have not done so already.
   1. Select PanoramaCloud ServicesConfiguration.
   2. Select Enable Multitenancy (located on the upper right of the page).
   3. Click OK.
      The Tenants page displays.
   4. In the Options area, select Clean Pipe.
      To configure a tenant for remote networks, mobile users, or both, see Manage Multiple Tenants in Prisma Access.

   5. Enter a Name for the first tenant.
   6. Create and configure a new Access Domain for the first tenant and click OK.

   7. In the Clean Pipe area, enter a Bandwidth (Mbps) for This Tenant.
      Enter a minimum of 100 Mbps for each tenant you create.
   8. Click OK.
3. Create zones for the tenant and map those zones for the tenant.
   1. Select NetworkZones.
      Make sure that selected the Clean Pipe Template for the tenant you created (cp-tpl-tenant).
   2. Create zones for the tenant (for example, Trust and Untrust).
   3. Select PanoramaCloud ServicesConfiguration and select the Tenant from the drop-down list.
   4. Select the Clean Pipe tab.
   5. Click the gear icon next to Zone Mapping to edit the settings.
   6. Add and Remove the zones you created to map them to trusted and untrusted zones.

4. Onboard a new Clean Pipe.
   1. Select PanoramaCloud ServicesConfigurationClean Pipe.
   2. Add a new Clean Pipe instance for the tenant, entering the following information:
      • Name—Specify a name for the clean pipe.
      • Bandwidth—Select the Bandwidth to allocate for the clean pipe.
        You can onboard Clean Pipe instances in increments of 100 Mbps, 200 Mbps, 300 Mbps, 400 Mbps, 500 Mbps, 1000 Mbps, 2000 Mbps, 5000 Mbps, and 10000 Mbps. The amount of bandwidth you specify must be within the licensed bandwidth allocation, and it must match the bandwidth of the VLAN attachment you create in the Partner Interconnect.
      • Edge Availability Domain—Select the availability domain you want for the clean pipe. You can choose 1, 2, ANY, or REDUNDANT.
        • Specify ANY for a non-redundant Clean Pipe deployment.
          Make sure that your cloud provider supports this choice; you must also select ANY on the cloud provider side of the partner interconnect. If that choice is not available for your cloud provider, make another choice.
        • To specify two VLAN attachments in the same location in an active/backup configuration in the same location, select REDUNDANT.
          Prisma Access creates two pairing keys for a REDUNDANT configuration (one for each availability zone), and appends the clean pipe name with zone1 for the first availability zone and zone2 for the second availability zone. For example, if you specify a Name of San Francisco, Prisma Access creates two zones named San Francisco-zone1 and San Francisco-zone2.
        Be sure that you configure the first availability zone (zone1) as the primary zone on your CPE.
        You can also build a pair of clean pipes for a single tenant redundancy in different locations; to do so, specify 1 for the first clean pipe in one location and 2 for the second clean pipe in a different location.
      • BGP Peer ASN—Enter the BGP Autonomous System Number (ASN).
        You can specify either a private or public BGP ASN.
        Make a note of this value; you configure it on the customer edge (CE) router when you complete the Clean Pipe configuration.
      • Location—Select the location.
        We recommend that you use the same location that you use when you create the VLAN attachment for the partner interconnect.
      • To enable QoS, select QoS, then select the QoS Profile to use with the clean pipe. Clean Pipe QoS shapes on ingress.

5. Add more Clean Pipe instances as required by repeating Step 4.
   Be sure that each additional Clean Pipe uses a different location.
6. Commit and push your changes to make them active in Prisma Access.
   1. Select CommitCommit and Push and Edit Selections in the Push Scope.
   2. Select Prisma Access, then select Clean Pipe.

   3. Click OK to save your changes to the Push Scope.
   4. Commit and Push your changes.
7. Check that your Clean Pipe has been provisioned.
   1. Select PanoramaCloud ServicesStatus.
   2. Select the Tenant from the drop-down list at the top of the page.
   3. Click Status.
      The Clean Pipe status displays.
   4. Hover over the Clean Pipe Config Status and wait until the status changes from Provisioning in Progress to Provisioned.
      This provisioning can take up to 30 minutes.

8. Click the Network Details tab, click the Clean Pipe radio button, and make a note of the Pairing Key.
   The MSSP CE and Cloud Router IP fields are blank when you start to configure the Clean Pipe. These fields populate after you create the VLAN Attachment when you complete the Clean Pipe configuration.

   If you specified a REDUNDANT connection, Prisma Access creates two pairing keys, one for each availability zone, and appends the clean pipe name with zone1 for the first availability zone and zone2 for the second availability zone. The following screenshot shows the SanFrancisco clean pipe with a redundant configuration; Prisma Access has created two pairing keys, one for SanFrancisco-zone1 and one for SanFrancisco-zone2.

   Be sure that you configure the first availability zone (zone1) as the primary zone on your CPE.

9. Complete the Clean Pipe Configuration.