Activate and Install Prisma Access (Panorama Managed)

Hub Roles and Prisma Access Installation

Activate and Install Prisma Access

1. When you receive the activation email from Palo Alto Networks, click Activate to activate your products.

   Select any of the links in the email to activate all of your licensed Prisma Access and Strata Logging Service products. You will be prompted to sign in to the Hub if you are not signed in already.
2. Select the products you want to activate; then, click Start Activation.

   In most cases, activate all products that display; however, if you want to associate Prisma Access with a Strata Logging Service you have already activated, deselect Strata Logging Service.

   If you have purchased the add-ons such as IoT or DLP, these products appear in the Add-on area.

   
3. Assign the products you selected with a Customer Support Account; then, click Next.

   If you have multiple support accounts associated with your email, select the account to which you want to assign the products.

   
4. Choose the Panorama appliance by selecting Setup new Panorama.

   
5. Follow the provided steps to register the new Panorama.

   
6. Choose the Strata Logging Service options; then, click Confirm Selections.

   • In the Strata Logging Service Selection area, choose whether to activate a new Strata Logging Service instance (Activate New), or select an existing Strata Logging Service instance.
   • In the Region Selection area, select a region for Strata Logging Service.

   

   The progress bar can appear to pause during product activation. Wait until the progress bar reaches 100%. The activation process takes approximately 20 minutes.
7. When setup is complete, copy the one-time password (OTP). You use this when you verify your account on Panorama.

   
8. Download and install the Cloud Services plugin.

   See the Palo Alto Networks Compatibility Matrix for the Panorama versions that are supported with the Cloud Services plugin.

   You can either download the plugin from the Customer Support Portal, or you can check for plugin updates directly from Panorama.

   • To download and install the Cloud Services plugin by downloading it from the Customer Support Portal, complete the following steps.
     1. Log in to the Customer Support Portal and select Software UpdatesPanorama Integration Plug In.
     2. Find the Cloud Services plugin in the Panorama Integration Plug In section and download it.
        Do not rename the plugin file or you will not be able to install it on Panorama.
     3. Log in to the Panorama Web Interface of the Panorama you licensed for use with the Prisma Access, select PanoramaPluginsUpload and Browse for the plugin File that you downloaded from the CSP.
     4. Install the plugin.
   • To download and install the Cloud Services plugin directly from Panorama, complete the following steps:
     1. Select PanoramaPlugins and click Check Now to display the latest Cloud Services plugin updates.

        

     2. Download the plugin version you want to install.
     3. After downloading the plugin, Install it.

   Installing a newer version of the Cloud Services plugin overwrites the previously installed version. If you are installing the plugin for the first time, after you successfully install, Panorama refreshes and the Cloud Services menu displays on the Panorama tab.

   
9. Retrieve the Prisma Access license(s).

   1. Select PanoramaLicenses and click Retrieve license keys from license server.
   2. Verify that you have the licenses for the Prisma Access components you plan to use.
10. Verify your account.

    When you try to use the Cloud Services plugin for the first time after installing it, you will be prompted to verify your account. This step ensures that the Panorama serial number is registered to use Prisma Access and enables a secure communication path between the Prisma Access components and Panorama.

    1. In Panorama, select PanoramaCloud ServicesConfiguration and click Verify.

       If Verify is disabled, check that you have configured a DNS server and NTP server on PanoramaSetupServices.

       

    2. Paste the One-time Password you copied and click OK.

       

       You have ten minutes to enter the OTP before it expires.

    You also have to re-verify your account every 3 months, which requires a new OTP. To generate a new OTP for the re-verification process, complete these steps.

    You must have superuser administrative rights to retrieve the OTP.

    • From the Palo Alto Networks hub, select Panorama, find the serial number of your Panorama appliance, select Generate OTP, and copy the OTP that is generated.

      

    • From the CSP, select AssetsCloud Services, select Generate OTP; then select the serial number of your Panorama appliance, generate the OTP, and copy the OTP that is generated.

      
11. Apply device group changes in the Prisma Access infrastructure.

    Prisma Access moves all device groups under the Shared hierarchy. This step applies the device group changes to your configuration.

    1. Select PanoramaCloud ServicesConfigurationService Setup.
    2. Click the gear icon to edit the Settings.
    3. Make sure that Service_Conn_Device_Group is selected as the Device Group Name and Shared is selected as the Parent Device Group.

       

    4. Click OK.

       Do not click Cancel, even if you did not make any changes to this page.
12. Continue to configure your Prisma Access deployment by Enabling the Service Infrastructure.