I want to know the difference between GlobalProtect and Prisma Access Agent

[Y.Choi436432]

Hi

While looking at the docs for Palo Alto GP and Prisma Access Agent, I had a question.

For convenience, we will refer to Prisma Access Agent as PAA.

Can someone explain the crucial differences that differentiate GP and PAA?

If we look at it only in terms of simple functions, PAA seems like it could replace GP.

Should the two products be considered separate products, or should PAA be considered a superior product that ultimately replaces GP?

If anyone could give me a hint I would appreciate it

[amy598batson]

---

@Y.Choi436432 wrote:

Hi

While looking at the docs for Palo Alto GP and Prisma Access Agent, I had a question.

For convenience, we will refer to Prisma Access Agent as PAA.

Can someone explain the crucial differences that differentiate GP and PAA?

If we look at it only in terms of simple functions, PAA seems like it could replace GP.

Should the two products be considered separate products, or should PAA be considered a superior product that ultimately replaces GP?

If anyone could give me a hint I would appreciate it

---

Hello @Y.Choi436432,

Prisma Access Agent (PAA) and GlobalProtect (GP) serve similar functions but differ in architecture and scope:

- GlobalProtect connects users to an on-prem or VM-based NGFW.
- Prisma Access Agent connects users to Palo Alto’s cloud-native firewall (FWaaS), offering broader scalability and simplified management.

Both use the same client interface, but PAA is part of a SASE solution, ideal for cloud-first environments. GP is better suited for traditional setups with local infrastructure. They are separate products—PAA doesn’t replace GP, but rather complements it depending on your network strategy. Choose based on your infrastructure and scalability needs.

Best Regards,
Amy Batson

[Y.Choi436432]

Hello amy598batson

Thank you very much for your reply.

Can I ask you one more thing?

If I am currently using GP and want to switch to PAA, do I need to purchase a license suitable for PAA?

[AlexHalbarth]

Hello,

I think the PAA is way more than you described, because there is also a documentation for NGFW connection already up in the docs.

https://docs.paloaltonetworks.com/prisma-access-agent/administration/license-and-activation/ngfw-sup...

The official announcement also mentions NGFW as a main Use-Case: https://www.paloaltonetworks.com/blog/sase/introducing-prisma-access-agent-the-future-of-secure-conn... 

What I was not able to find is information on what is the actual difference between GP and PAA on NGFW and when to use what in the future.

Maybe someone found that already?

Thanks!

[Y.Choi436432]

Hi AlexHalbarth

Thank you for reply

The question I have now is the same as what you mentioned.

I thought I'd post this to see if anyone knows anything about it, since it looks like all agents will eventually be integrated into PAA.

I had previously checked the 'docs' mentioned above, but sadly I had difficulty understanding exactly how my relationship with GP would change.

Anyway thanks for your help