topic Re: I want to know the difference between GlobalProtect and Prisma Access Agent in GlobalProtect Discussions

I want to know the difference between GlobalProtect and Prisma Access Agent

Y.Choi436432 — Tue, 22 Jul 2025 07:23:23 GMT

While looking at the docs for Palo Alto GP and Prisma Access Agent, I had a question.

For convenience, we will refer to Prisma Access Agent as PAA.

Can someone explain the crucial differences that differentiate GP and PAA?

If we look at it only in terms of simple functions, PAA seems like it could replace GP.

Should the two products be considered separate products, or should PAA be considered a superior product that ultimately replaces GP?

If anyone could give me a hint I would appreciate it

Re: I want to know the difference between GlobalProtect and Prisma Access Agent

amy598batson — Tue, 22 Jul 2025 08:24:30 GMT

@Y.Choi436432 wrote:
Hi

While looking at the docs for Palo Alto GP and Prisma Access Agent, I had a question.
For convenience, we will refer to Prisma Access Agent as PAA.
Can someone explain the crucial differences that differentiate GP and PAA?
If we look at it only in terms of simple functions, PAA seems like it could replace GP.
Should the two products be considered separate products, or should PAA be considered a superior product that ultimately replaces GP?

If anyone could give me a hint I would appreciate it

Hello @Y.Choi436432,

Prisma Access Agent (PAA) and GlobalProtect (GP) serve similar functions but differ in architecture and scope:

- GlobalProtect connects users to an on-prem or VM-based NGFW.
- Prisma Access Agent connects users to Palo Alto’s cloud-native firewall (FWaaS), offering broader scalability and simplified management.

Both use the same client interface, but PAA is part of a SASE solution, ideal for cloud-first environments. GP is better suited for traditional setups with local infrastructure. They are separate products—PAA doesn’t replace GP, but rather complements it depending on your network strategy. Choose based on your infrastructure and scalability needs.

Best Regards,
Amy Batson

Re: I want to know the difference between GlobalProtect and Prisma Access Agent

Y.Choi436432 — Wed, 23 Jul 2025 00:58:45 GMT

Hello amy598batson

Thank you very much for your reply.

Can I ask you one more thing?

If I am currently using GP and want to switch to PAA, do I need to purchase a license suitable for PAA?

Re: I want to know the difference between GlobalProtect and Prisma Access Agent

AlexHalbarth — Tue, 29 Jul 2025 11:25:02 GMT

Hello,

I think the PAA is way more than you described, because there is also a documentation for NGFW connection already up in the docs.

https://docs.paloaltonetworks.com/prisma-access-agent/administration/license-and-activation/ngfw-support-for-prisma-access-agent

The official announcement also mentions NGFW as a main Use-Case: https://www.paloaltonetworks.com/blog/sase/introducing-prisma-access-agent-the-future-of-secure-connectivity/

What I was not able to find is information on what is the actual difference between GP and PAA on NGFW and when to use what in the future.

Maybe someone found that already?

Thanks!

Re: I want to know the difference between GlobalProtect and Prisma Access Agent

Y.Choi436432 — Wed, 30 Jul 2025 01:09:29 GMT

Hi AlexHalbarth

Thank you for reply

The question I have now is the same as what you mentioned.

I thought I'd post this to see if anyone knows anything about it, since it looks like all agents will eventually be integrated into PAA.

I had previously checked the 'docs' mentioned above, but sadly I had difficulty understanding exactly how my relationship with GP would change.

Anyway thanks for your help