Prisma Access 2.0 - Release FAQ

[Sai_Tumuluri]

Last updated: April 22, 2021

2.0 Releases

2.0-Preferred & Innovation Release Preview

What is 2.0 Preferred and 2.0 Innovation Release?  Prisma Access 2.0 introduces two Cloud Services plugin versions:  Cloud Services Plugin 2.0 Preferred—Runs on the PAN-OS 9.1.7 dataplane, which is the recommended release Palo Alto Networks SRE will release the plugin to customers after a successful dataplane has been deployed across all of their Prisma Access location on Mondays, 11 PM PDT. More details here.

Supported Versions

Supported Version

What are the supported versions of Panorama, Cloud Services Plugin and GlobalProtect? Panorama: 9.1.4 or a later PAN-OS version of 9.1.x (PAN-OS 10.0.3 required to activate and use PAN-OS 10.0 features) 10.0.3 or a later PAN-OS version of 10.0.x GlobalProtect Client: Supported version: 5.0.6+, 5.1.x, and 5.2.x Recommended version: 5.1.8 and 5.2.4+ 5.0.6+ is End of Support on May 31st, 2021. . More details here.

Changes to Default Behavior

Changes to default behavior	What are the changes to default behavior? Changes to default behavior are captured here.
Egress IP	What are the IP address changes and how should my customers prepare for it? Egress IP API changes are called out here.

Upgrade Schedules

Infra upgrade	When will I get notified about an Infrastructure upgrade? Subscribe to updates from the Palo Alto Networks Status Page to get notified about any upcoming infrastructure upgrade. This update provides information about what you should expect during the infrastructure upgrade window.
Dataplane upgrade	When will I get notified about the Dataplane upgrade? You will receive a notification 21 days before the scheduled upgrade. All notifications are via Insights apps. For more details check here.
Plugin Release	Palo Alto Networks SRE will release the plugin to customers after a successful dataplane has been deployed across all of their Prisma Access location on Mondays, 11 PM PDT. If you do not get the latest Plugin after the upgrade, please contact your Palo Alto Networks account rep to open a PASRE ticket.
Communication	What if I don't have the Insights App/Prisma Access App? Login to apps.paloaaltonetworks.com with your Palo Alto Networks Support SSO credentials and look for the Prisma Access app. If you don’t find the app, reach out to your Palo Alto Networks account representative.

[c_larrazabal]

Hello! I have two questions:

- Is there any downtime during the upgrade? For example, in our case we have deployed 3 gateway locations, if just one location is being upgraded at a time we won't have any downtime right? Because we have other 2 locations operating.

- When choosing the upgrade preference, what is the best practice? Choosing the main gateway location we use or upgrading first a gateway location we don't normally use?

Thanks & Regards.

[wrigsp]

We choose a set of gws that we don't use much (we do have 99 so great coverage) so we could,

1) connect and use them the week before to baseline how they perform,

2) connect to them after the migration and compare to the first week,

3) know we have stable gateways ready for when the remainder were moved the following weekend.

Our experience was that for a user connected to a gwy that was migrated while still being used we had max 45 seconds for the GP client to re-connect to an alternative gwy. This matched our failover testing performance tests.

Best,

Simon.