Learn about the requirements you need for Clean Pipe
Before you start, be aware of the following Clean Pipe
deployment requirements, and be aware of the following differences
between Prisma Access for Clean Pipe and other Prisma Access deployments:
You must have a Prisma Access for Clean Pipe license.
Prisma Access for Clean Pipe license is a separate license from
other Prisma Access products. However, the same requirements for
purchasing and installing Panorama and Cortex
Data Lake licenses apply to Clean Pipe.
Prisma Access for Clean Pipe has the following GCP Partner
You must be able to create
a Partner Interconnect in GCP.
You must have the ability to create VLAN attachments in GCP.
For Layer 2 (L2) partner interconnects, you must have access
to the customer edge (CE) router on the MSSP side and be able to
make configuration changes to it.
If configuring multiple Clean Pipes for a single tenant,
each Clean Pipe is required to be a unique location. If you want
to configure two VLAN attachments for a single Clean Pipe location
in an active/backup configuration for intra-zone redundancy, specify
When creating a connection within a Clean Pipe tenant, match
the bandwidth allocation to that of the VLAN attachment. Do not
create a VLAN attachment that has a bandwidth that is higher or
lower than the connection's bandwidth.
After you enable multitenancy, do
not configure your Clean Pipe deployment with any of the other tabs
in the Configuration area, with the exception of the
link in the
which lets you generate an API key to retrieve Clean Pipe
IP addresses. All configuration is unique to Prisma Access for
Clean Pipe and separate from other Prisma Access deployments, such
as Prisma Access for Networks or Prisma Access for Users.
Do not make changes to a Clean Pipe configuration after you
commit it. If you change a Clean Pipe after it’s been committed,
you will receive a commit error when you re-commit it. Instead, delete
the existing Clean Pipe and add a new one. Schedule this change
during a system downtime window. If you already made changes and
have not yet committed, you can revert the changes by editing the
Clean Pipe configuration back to their previous values.
Note that the locations used by Clean Pipe differ from other
Prisma Access deployments. Prisma Access for Clean Pipe supports
the following locations:
Note the following networking restrictions for Clean Pipe: