Features Introduced in Prisma Access 1.8
The following table describes the new features introduced in Prisma Access version 1.8.
The 1.8 Cloud Services plugin is currently available for new customers only. If you are currently using the Cloud Services plugin version 1.7, you can continue with it and are not required to upgrade to the 1.8 plugin. If you want to upgrade to the Cloud Services plugin version 1.8, contact your authorized Palo Alto Networks representative or partner to schedule an upgrade.
The following features are available if you are using the 1.7 plugin without upgrading to 1.8:
- Pre-Allocate IP Addresses for Mobile User Locations—These API enhancements are available to 1.7 customers.
- Compute Location Changes—If you add locations with compute location changes after Prisma Access 1.8 is released, Prisma Access associates the new compute locations automatically. If you have already onboarded these locations, complete the steps described in the following table to change the compute location.
A minimum Panorama version of 9.1.2 is required to install the Cloud Services plugin 1.8.
Prisma Access introduces changes to licensing. The new licensing model allows you to implement and use the capabilities of Prisma Access aligned to your business needs in a way that delivers the fastest return on investment. Whether your applications are migrating to the cloud, your users are working from anywhere, or if you are looking to gain operational efficiencies, Prisma Access offers the relevant type of license for your deployment.
There are no changes to licensing for existing Prisma Access deployments.
Choose from the following license editions:
ZTNA SIG is available for Prisma Access for Mobile Users only; you can use all other editions with Mobile Users, Remote Networks, or both mobile users and remote networks.
All license editions are available for Local and Worldwide Prisma Access locations. When you purchase a license with Worldwide locations, you can deploy Prisma Access in all Prisma Access locations. When you purchase a license with Local locations, you can select up to 5 Prisma Access locations. For more details about what is available with the new licenses, see the Prisma Access Licensing Guide.
You allocate bandwidth for remote networks at an aggregate level per compute location.
The aggregate bandwidth model is available for all new Prisma Access 1.8 deployments and for existing deployments that have not had any remote networks onboarded before upgrading to 1.8. If you have an existing Prisma Access deployment that has onboarded remote networks and you then upgrade to Prisma Access 1.8, this model does not apply and you still apply bandwidth per location.
Each location has a corresponding compute location for which bandwidth is allocated, and all sites you onboard in a compute location share that allocated bandwidth. For example, you want to onboard four branch offices using remote networks in the Singapore, Hong Kong, Thailand, and Vietnam locations. All these locations map to the Asia Southeast compute location. If you allocate 200 Mbps bandwidth to the Asia Southeast compute location, all four branch offices will share the 200 Mbps of bandwidth.
If one or more sites are not using a large amount of bandwidth, Prisma Access makes the remaining bandwidth available to other sites in that compute location.
Prisma Access introduces an enhancement to the API you use to retrieve IP addresses that allows you to reserve gateway and portal IP addresses for mobile user locations ahead of time, before you enable them. This ability lets you add the mobile user egress IP addresses to your organization’s allow lists before you onboard the locations, which in turn gives mobile users access to external SaaS apps immediately after you onboard the locations.
The API response also includes the public IP pool subnets that are the source for the egress IP addresses for the requested locations.The gateway and portal addresses of any locations you add will be a part of this subnet. Adding the subnets to your allow lists provides for future location additions without allow list modification and is beneficial if your organization’s allow list size is limited.
The IP addresses and subnets are valid for 90 days after you retrieve them and expire after the validity period if you do not use them.
This enhancement works for existing customers who are using the Cloud Services plugin 1.7 with no additional configuration changes required.
Prisma Access increases its maximum fully-supported remote network bandwidth from 300 Mbps to 500 Mbps, and 500 Mbps is now supported with SSL decryption.
If you have a Prisma Access for Users license, you can quickly resolve mobile user connection, performance, and access issues by having GlobalProtect users generate and send an easy to read, comprehensive report from the end user’s endpoint to Cortex Data Lake for further analysis.
You are required to use CLI to set up a client certificate to be used between the GlobalProtect app and Cortex Data Lake. See Set Up GlobalProtect Connectivity to Cortex Data Lake for details.
To optimize performance and improve latency, Prisma Access adds a new compute location in Japan and also changes the mapping of the following locations:
If you add the locations after your organization installs the 1.8 plugin, Prisma Access associates the new compute locations automatically.
This enhancement works for existing customers who are using the Cloud Services plugin 1.7; however, if you have already onboarded these locations, complete the following steps to take advantage of the new compute location:
To reduce down time for mobile user deployments, you can use the new API to pre-allocate the new gateway and portal IP addresses before you perform these steps.
Since you need to allow time to delete and add the existing location and change your allow lists, Palo Alto Networks recommends that you schedule a compute location change during a maintenance window or during off-peak hours.
Prisma Access will offer the following enhancements to assist you when sharing public address space externally and internally with private apps:
Prisma Access supports the use of the WildFire UK cloud for Prisma Access (
uk.wildfire.paloaltonetworks.com), which is designed to adhere to data sovereignty and residency laws as well as established data protection and privacy regulations.
Recommended For You
Recommended videos not found.