Enable Multitenancy and Migrate the First Tenant

Use the following workflow to enable multitenancy and migrate your existing configuration to the first tenant you create. If you don’t have any existing configuration, you can Enable Multitenancy and add your tenants; then configure them.
When you enable multitenancy, Prisma Access migrates the following components of your configuration:
  • All service connection and remote network tunnel onboarding information, including tunnel configuration.
  • Existing mobile users onboarding information.
  • Cortex Data Lake information.
  • Any existing Autonomous DEM (ADEM) configuration
  • The templates, template stacks, and device groups for service connections, remote networks, and mobile users.
You need to specify the amount of users (for a mobile user deployment), bandwidth (for a remote networks deployment), and Autonomous DEM (ADEM) to allocate for each deployment (if you have purchased an ADEM license).
Because of these device group changes, you create an access domain and add the migrated device groups, templates, and template stacks, as shown in the following workflow.
If you don’t have an existing Prisma Access configuration, and you are creating an all-new multitenant deployment, do not use this workflow; instead, complete the steps in Add Tenants to Prisma Access to create the first tenant.
  1. Determine the amount of licensed units you want to allocate to this deployment.
    While Prisma Access migrates your configuration to the first tenant, you need to specify:
    • The
      to allocate for the tenant’s remote users deployment (if applicable).
    • The
      to allocate for the tenant’s mobile users deployment (if applicable).
    • The amount of ADEM units to allocate for mobile uses and remote networks (if applicable).
  2. Select
    Cloud Services
  3. Select
    Enable Multitenancy
    (located on the upper right of the page).
    After you enable multitenancy, Panorama displays a notification informing you that the existing Prisma Access configuration will be moved to the first tenant.
    After you enable multitenancy, your deployment permanently changes to a multitenant deployment, and you cannot revert to single tenant mode.
  4. Click
    to migrate the existing configuration to the first tenant.
    page displays, and pie charts in the center of the window display.
    • If you have a remote networks or mobile users license, the available amount of licensed remote network bandwidth and mobile users display.
    • (
      Remote Networks and Mobile User Deployments Only
      ) If you have purchased an Autonomous DEM license, the available number of units for ADEM uses displays.
    • If you have a Clean Pipe deployment, the amount of bandwidth for the tenant displays.
  5. Choose the type of deployment you want to use for the tenant.
    • For a remote network, mobile user deployment, or to configure both deployment types for a tenant, select
      Remote Networks/Mobile Users
    • For a clean pipe deployment, select
      Clean Pipe
      This section only describes how to configure tenants for remote network, mobile user, or both remote network and mobile user deployment types. To configure the clean pipe service, see Create and Configure Prisma Access for Clean Pipe.
  6. Migrate the existing configuration to the first tenant.
    1. Specify a
      for the first tenant.
    2. Create a new
      Access Domain
      by clicking the down arrow selecting
      New Access Domain
    3. Enter a
      for the access domain and click
      Prisma Access adds the
      , and
      Device Groups
      to the new access domain.
    4. (
      ) Click
      to verify that Prisma Access added the following templates and template stacks:
      • Explicit_Proxy_Template
      • Explicit_Proxy_Template_Stack
      • Mobile_User_Template
      • Mobile_User_Template_Stack
      • Remote_Network_Template
      • Remote_Network_Template_Stack
      • Service_Conn_Template
      • Service_Conn_Template_Stack
        These are the default template stacks and templates for a standard Prisma Access deployment; if you added other templates, be sure that Prisma Access added them.
    5. (
      ) If you have other templates associated with this configuration, select them.
    6. Click
      to close the
      Access Domain
      page and return to the
  7. Enter the values in
    Bandwidth (Mbps)
    for remote networks,
    for mobile users, and the number of
    Autonomous DEM Users
    you want to allocate for each deployment type.
    Use the following guidelines when allocating ADEM units for a tenant:
    • The number of ADEM units you can allocate for mobile users and remote networks can be only equal to or less than base license.
    • The minimum number of units you can allocate is 200.
    • After you allocate the ADEM units for a tenant, you can edit or remove those units.
    • If you did not purchase an ADEM license for your deployment type (Mobile Users or Remote Networks), that choice is grayed out.
  8. Click
    Cloud Services
    page shows the first tenant successfully migrated, and a
    drop-down is added above the
  9. Select the tenant you just created in the
    drop-down to verify that all settings were onboarded.
  10. Commit and push your changes to make them active in Prisma Access.
    1. Select
      Commit and Push
      Edit Selections
      in the Push Scope.
    2. Select
      Prisma Access
      , then select the tenant you created,
      Service Setup
      Remote Networks
      , and
      Mobile Users
    3. Click
      to save your changes to the Push Scope.
    4. Commit
      your changes.
  11. Select
    Cloud Services
    The status page shows the status of all tenants. Because you have created only one tenant, that tenant is the only one that is shown. If you select that tenant from the drop-down, you show a detailed status of that tenant.
    Selecting a tenant from the drop-down list returns you to the Status page for that tenant.
  12. Continue to add more tenants to Prisma Access.

Recommended For You