Total consumption of licenses allowed for Prisma Access Global Protect

[Marcelo_Campos]

Hello everyone,

Today one of our clients informed us that at a certain time of the day, users connected to the Globalprotect Prisma Access vpn began to suffer random disconnections.

The service is Prisma Panorama Managed, we began to discard the system logs and the service route from on-premises to the cloud services, without finding logs of disconnection or restart of the ipsec tunnel.

The only traceable thing about the review was to show a peak consumption of licenses for today.

According to the above I have 2 queries

First, it is possible that at that specific time the cloud service had some downtime or maintenance window (how can I verify this?)

Second, when the license limit is reached, does Prisma access allow you to continue associating/connecting users via gp? or start to revoke and/or reuse licenses?

The problem was fixed without intervention when the load of connected users dropped.

please your help thanks in advance.

Prisma Access #prisma

[Haris_Chughtai]

There could be many reasons for random disconnect like back-end infra maintenance or the load on the SPN nodes. In our case when we noticed sudden drops, upon investigation it was identified that few SPNs were having more connections than others. We enabled hot-potato routing  and added more Service Connections. As per PAN best practices guidelines, there should be one service connection per 5000 users. Though in my view we can surely have more user connections but in that case capacity must be watched closely for any potential issues.

Regarding when the licences are reached the capacity, as per the documentation, when it occurs consistently for three months,  Prisma Access will allow users continue to connect however it will generate alarm notification to purchase more licences. There is no mention that service will stop working.