New Features Introduced in Prisma Access 3.0

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Community Team Member



Prisma Access secures access to the cloud for branch offices and mobile users anywhere in the world with a scalable, cloud-native architecture that will soon be managed via a new, streamlined cloud management UI. Prisma Access blends enterprise-grade security with a globally scalable network that is soon available in more than 100 locations. In addition, service provider partners will be able to rapidly enable secure outbound internet connectivity for their customers.



New Features—Cloud Services Plugin 3.0 Preferred


The following table describes the new features that will be available with Prisma Access 3.0 Preferred.


Qos Support for Remote Networks

Prisma Access will support Quality of Service (QoS)for remote networks that allocate bandwidth by compute location. If you are using the bandwidth allocation per compute location model, you will be able to add QoS profiles to prioritize traffic per site. 


If you have a deployment that allocates bandwidth by location and uses QoS, do not migrate to a deployment that allocates bandwidth by compute location; migrations with QoS are not supported.

IP Allow Listing of Prisma Access Public IP Addresses from the Prisma Access UI
You will be able to indicate whether or not you use Prisma Access public IP addresses for IP allow listing. You will be able to retrieve the Prisma Access public IP addresses from Panorama (for Panorama Managed Prisma Access deployment) or the Cloud Managed Prisma Access UI (for Cloud Managed Prisma Access deployments) for allow listing purposes. After you make a note of the IP addresses, you add them to your organization's allow lists, then return to Panorama or the Prisma Access UI and mark them as added. You can also note any IP addresses that have not been added to your organization’s allow lists. In this way,Prisma Access uses only the IP addresses you have added to your allow lists in case of an autoscale eventor infrastructure upgrade.
Google IdP Support for Cloud Identity Engine To simplify the retrieval of user and group information for deployments that use Google Identity for cloud identity services, Prisma Access will support Google Identity integration with the Cloud Identity Engine.
Mobile User Regional Redundancy

To ensure that your mobile users always have access to the services and applications that are accessible from service connections, you will be able to enable network redundancy during mobile user setup. This feature provides redundant network paths between the mobile user dataplane and service connections that may be in different compute locations.


Enabling redundancy provides you with more resilient access to resources behind service connections in a data center or headquarters location. Because a service connection is required for mobile users to access resources from remote networks, you also have more resiliency in accessing resources in remote network locations.


For either a Cloud Managed or PanoramaManaged Prisma Access deployment, the following prerequisites are required before this feature is enabled:

      • Onboard multiple service connections in different compute locations.
      • Enable asymmetric routing and load sharing across service connections in your Backbone Routing options.

For Cloud Managed deployments, select Manage > Service Setup > Service Connections > Advanced Settings and make sure that the Backbone Routing option is set to Allow asymmetric routing and load sharing across Service Connections. Prisma Access enables this feature without further configuration.


For Panorama Managed deployments, select Panorama > Cloud Services > Configuration > Service Setup, click the gear to edit the Settings, and, in the Advanced tab, make sure that the Backbone Routing option is set to asymmetric-routing-with-load-share.


        • (Panorama Managed Deployments only) Enable network redundancy by selecting PanoramaCloud Services > Configuration > Mobile Users —GlobalProtect, selecting the Hostname and, in the General tab, selecting Enable Network Redundancy. 
Prisma SD-WAN CloudBlade Thin Client Integration with Cloud Services Plugin
For Prisma SD-WAN integrations with Prisma Access, the Cloud Services plugin will include a built-in CloudBlade thin client that eliminates the requirement to have a Docker container host or Kubernetes environment to host a separate CloudBlade. This integration enables easier onboarding of Prisma SD-WAN devices using remote network connections.
Maximum Size Increase for External Dynamic Lists


To allow you to use existing firewall security policy rules and related objects with Prisma Access toimplement a consistent security posture across your network, Prisma Access will increase the maximum size for External Dynamic Lists (EDLs) to the following maximums:


  • 150,000 IPs for IP-based EDLs
  • 1250,000 URLs for URL-based EDLs

Note: To activate this feature on your service tenant, reach out to your Palo Alto Networks account representative and submit a request.

FedRAMP Moderate Support


Panorama Managed Prisma Access has been authorized for FedRAMP Moderate support. Make a note of the following requirements and guidelines to follow when enabling, configuring, and using Prisma Access in a FedRAMP Moderate environment:

  • The Panorama that manages Prisma Access must be running 10.0.7 software. Cloud Managed Prisma Access is currently not authorized for FedRAMP Moderate support.
  • Palo Alto Networks requires that you enable Federal Information Processing Standard and Common Criteria (FIPS-CC) support on the Panorama that manages Prisma Access.
  • You cannot migrate from an existing Prisma Access deployment. You deploy a new FedRAMP Moderate Prisma Access environment using the activation link based on the PAN-FEDRAMP-MOD SKU.
  • Prisma Access FedRAMP Moderate requires Palo Alto Networks US Government Support Services, which includes 24x7 support for United States personnel on United States soil.
  • The GlobalProtect version of 5.1.4 is FIPS certified and is the default version to use for Federal Government-based deployments. If you change the default GlobalProtect version from 5.1.4, you will not be able to select version 5.1.4 from the Panorama UI and will need to open a Support case with Palo Alto Networks Technical Support to add it back.
  • The following locations are authorized for use with Prisma Access, which includes support for locations in the continental United States (CONUS) and outside the continental UnitedStates (OCONUS):
    • Australia Southeast
    • Belgium
    • Brazil South
    • Canada East
    • Finland
    • Germany Central
    • India West
    • Japan Central
    • Japan South
    • Netherlands Central
    • Singapore
    • Switzerland
    • Taiwan
    • United Kingdom
    • US Central
    • US East
    • US Northwest
    • US Southeast
    • US Southwest
  • The following apps and tools are not supported for use in a Prisma Access FedRAMP Moderate environment:
Protect from Web-Based Threats with RBI Using Proofpoint
To support a larger range of use cases and prevent malware, phishing, crypto mining, and other threats, Prisma Access will add Proofpoint as a technology partner to implement Remote Browser Isolation (RBI) using URL response page redirect to the RBI cloud. The RBI integration helps with isolating all active, untrusted web content from endpoints that your 
users use to access business-critical internet services and internal networks, and ensure that the corporate network remains safe.
WildFire India Cloud Support

To allow you to adhere to data sovereignty and residency laws as well as established data protection and privacy regulations, Prisma Access supports the use of the WildFire India Cloud ( The following locations map to the WildFire India Cloud:

  • India North
  • India South
  • India West
WildFire API Support You will be able to extend the malware detection capabilities of WildFire using the WildFire APIYou can use the WildFire API to query WildFire for verdicts, samples, and reports, and to automate the submission of files and links to WildFire for analysis.
Explicit Proxy Enhancements

Prisma Access provides the following enhancements for Explicit Proxy:

  • Support for Deployments with No Default Route at Branch Sites—To help you transition from a proxy-based architecture in your branch sites to Prisma Access, a Prisma Access deployment will be supported for branch sites that have a no-default route architecture. This deployment, which uses remote networks in conjunction with Explicit Proxy, provides security inspection using a remote network Security Processing Node (RN-SPN), while users and servers use the PAC file to forward the traffic to Prisma Access.
  • Inline Editing of PAC Files—You will be able to edit the PAC file used with Explicit Proxy in the Cloud Managed UI.
  • Best Practice Assessment for Explicit Proxy Policies— Cloud Managed Explicit Proxy deployments will include a best practice check for security policy rules that are used with Explicit Proxy.
New Prisma Access Compute Locations

To optimize performance, improve latency, and adhere to data sovereignty rules, Prisma Access adds the following compute locations, and the following locations map to these compute locations:

    • Australia South Compute Location— Mapping to Australia South and Australia Southeast locations.
    • Canada Central (Toronto) Compute LocationMapping to Canada Central location.
    • India North Compute Location—Mapping to the India North location.

If you add the locations after you install the Cloud Services 3.0 plugin, Prisma Access associates the new compute locations automatically.


Note: For Explicit Proxy, these new compute locations are supported for new deployments only.


If you are upgrading from an existing Prisma Access deployment and you have already onboarded these locations, complete the following steps to take advantage of the new compute location:

  1. Delete the location associated with the new compute location.
  2. Commit and push your changes.
  3. Re-add the locations you just deleted.
  4. Commit and push your changes.
  5. Retrieve the new gateway and portal IP addresses (for mobile users) or the new egress IP addresses (for remote networks) using the API script.
  6. Make a note of the new IP addresses and add them to your allow lists.

Since you need to allow time to delete and add the existing location and change your allow lists, Palo Alto Networks recommends that you schedule a compute location change during a maintenance window or during off-peak hours.

EDL Custom Category End Token Support

If you use URLs in custom URL categories or external dynamic lists (EDLs) and do not append an ending token such as . / ? & = ; +, it is possible to allow more URLs than you intended. For example, entering as a matchingURL instead of would also match or


Prisma Access will allow you to set an ending token to URLs in EDLs or custom URL categories so that, if you enter, Prisma Access treats it as it would treat and only matches that URL.



New Features—Cloud Services Plugin 3.0 Innovation


Version 3.0 Innovation includes all the all the features in 3.0 Preferred and adds the following features.


Support for PAN-OS 10.1

Cloud Services 3.0 Innovation uses a dataplane version of PAN-OS 10.1 and you are able to take advantage of PAN-OS 10.1 features up to PAN-OS10.1, including the following features:

Explicit Proxy Enhancements

In addition to the Explicit Proxy enhancements described for 3.0 Preferred, Prisma Access offers the following additional enhancements for 3.0 Innovation:

  • SNI Spoofing Prevention—Explicit Proxy will be able to protect network traffic from Server Name Indication (SNI) spoofing attacks in cases where the SNI domain does not match the domain used for HTTP Requests or HTTP Connect requests.
  • DNS Security Signature Category AdditionsExplicit Proxy will support the following additional DNS security signature categories:
    • Dynamic DNS Hosted Domains
    • Grayware Domains
    • Newly Registered Domains
    • Parked Domains
    • Phishing Domains
    • Proxy Avoidance and Anonymizers 

Command and Control Domains and Malware Domains are currently supported DNS security signature categories.

SaaS Security Inline Enforcement In addition to the SaaS Visibility feature that was introduced with Prisma Access 2.2 Preferred, you will be able to import SaaS policy recommendations from SaaS Security Inline to gain control of the applications in the policy recommendation.
Commit Error Reporting Improvements

When you receive configuration-related errors during commits, Prisma Access has replaced generic 

<meta charset="utf-8" />

messages you previously received with messages that more clearly communicate the cause of the misconfiguration. For example, authentication objects without authentication profiles receive a message indicating the object with the missing profile instead of a generic message indicating an issue with the commit.


Other message improvements include:

  • HIP profiles that exceed the maximum allowed
  • Missing or overlapping IP addresses, or missing URLs, in objects for a mobile user (GlobalProtect) deployment
  • IPv6 addresses being specified when IPv6 addressing has not been enabled in a Prisma Access deployment
  • Port numbering being outside of the valid range (0-65535)
  • EDL-related validation errors
  • Security policy-related rule validations (missing service value, using Negate with Any for Source or Destination)
  • Missing SCEP certificates when using SSL Authentication



For more information about Prisma Access, please visit the LIVEcommunity Prisma Access Technologies page for a complete Customer Journey Guide, events, webinars, videos, and discussions dedicated to Prisma Access.


Feel free to share your questions, comments and ideas in the section below!


Thank you for taking time to read this blog.

Don't forget to hit the Like (thumbs up) button and to Subscribe to the LIVEcommunity Blog area.


Kiwi out!

Register or Sign-in