SERVICES PROGRAMS

LAB REQUIREMENTS
Authorized Support Center (ASC)
Authorized Professional Services (APS)

April 2025

© 2023 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.
LAB REQUIREMENTS*

Hardware Cortex XDR Pro per Modules Branch

endpoint or TB
● PA-1410 or higher - (min Qty ● Prisma Access for mobile users ● ION 1000 or higher
● XDRCIE - Cloud Identity
2) ● Prisma access for Remote
● EngineCortex XDR portal and
● Palo Alto Networks PA-1410 networks
● Agent Cortex XDR 7.2 or above
with redundant AC power
supplies
Cortex XDR Pro License Datacenter
Subscription
subscription:
● PA-1410 ● Detection, investigation, and ● Prisma Access for Mobile Users ● ION 9000 or higher
● PAN-PA-1410-BND-NFR4 response across endpoint data (min 100 license)
● (PA-1410, NFR bundle sources ● Prisma access for Remote License
subscription (Advanced Threat ● Endpoint protection with networks
prevention, DNS,Advanced URL filtering,
GlobalProtect, Advanced WildFire,
Cortex XDR agents ● Cortex Data Lake - 1TB ● NFR Bundle (150Mbps Branch
SD-WAN, Standard support), 1 year (12 ● Panorama VM Subscription, ZBFW, DVR,
months) term. WAN Clarity Reporting)

© 2023 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.
 NETWORK SECURITY

© 2023 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.
NETWORK
HARDWARE SUBSCRIPTION
SECURITY
PA-1410 or higher - (min Qty 2) PAN-PA-1410-BND-NFR4
LAB
REQUIREMENTS Palo Alto Networks PA-1410 with
redundant AC power supplies
PA-1410 NFR bundle subscription
Advanced Threat prevention, DNS, Advanced URL filtering,
GlobalProtect, Advanced WildFire, SD-WAN, Standard
support), 1 year (12 months) term

Product Model Quantity Part Name Description

SKUs Firewall (NGFW) PA-1410 2 PAN-PA-1410-NFR Palo Alto Networks PA-1410 NFR Unit with redundant AC power supplies
RECOMMENDATIONS PA-1410, NFR bundle subscription (Advanced Threat prevention, DNS,
Licenses PA-1410, NFR 2 PAN-PA-1410-BND-NFR4 Advanced URL filtering, GlobalProtect, Advanced WildFire, SD-WAN, Standard
support), 1 year (12 months) term.

Panorama Panorama 2 PAN-PRA-25-NFR Panorama Central Management Software, 25 device NFR license

NFR Reference SKUs*

© 2023 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.
 PRISMA ACCESS / SD-WAN

© 2023 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.
 PALO ALTO NETWORKS PROVIDES TWO OPTIONS FOR MANAGING PRISMA ACCESS USES CORTEX
PRISMA PRISMA ACCESS DATA LAKE TO STORE LOGS

ACCESS PANORAMA MANAGED CLOUD MANAGED PRISMA

PRISMA ACCESS via ClOUD ACCESS with THE PRISMA CORTEX DATA LAKE
SERVICES PLUGIN ACCESS APP

LAB
REQUIREMENTS ● There are two ways you can manage Prisma Access, but you can't switch ● Provides public cloud scalability
between the management interfaces after you activate your Prisma Access across multiple secure locations
license. So, you must decide how you want to manage Prisma Access before ● Enables AI-based innovations to
you get started. normalize, analyze and stitch
● To learn more about how to manage Prisma Access, check Prisma Access together customer’s enterprise
Overview, How to Manage Prisma Access & Prisma Access Journey Guide data to detect hard to find
security issues

Product Model Quantity Part Name Description

Prisma Access Panorama 1 PAN-PRA-25-NFR Panorama Central Management Software, 25 device NFR license

SKUs Prisma Access NFR, includes all features for Enterprise Edition, Users,
Prisma Access Prisma Access 100 PAN-PRISMA-ACCESS-MU-NFR 5 Service Connections and 10 ZTNA Connectors, Standard Success
RECOMMENDATIONS Plan (can be purchased as 100 units, upto 1000 units)

Prisma Access NFR, includes all features for Enterprise Edition, Site
Prisma Access Prisma Access 1 PAN-PRISMA-ACCESS-SITE-NFR bandwidth up to 50 Mbps, 5 Service Connections and 10 ZTNA
Connectors, Standard Success Plan (can be purchased upto 10 Sites)

Strata Logging Service NFR subscription for Prisma Access Mobile

Prisma Access Prisma Access 100 PAN-PRISMA-ACCESS-MU-SLS-NFR
Users. Price per user

© 2023 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.
 THE PRISMA SD-WAN SOLUTION INCLUDES TWO KEY ELEMENTS*

PRISMA PRISMA SD-WAN CONTROLLER

ION DEVICES
ION devices enable you to combine disparate WAN networks, such as; MPLS, LTE, and internet links, into a

SD-WAN single, high-performance, hybrid wide area network (WAN)

Access the SD-WAN controller through Physical or virtual devices that serve as a Physical or virtual devices serve as a forwarding
an intuitive graphical user interface forwarding x86 commodity-based element at x86 commodity-based element at a branch or
that helps you manage your network. a branch. ION 1200 a data center.
The SD-WAN web interface enables
LAB you to perform the following tasks: ● The Analytics mode provides detailed information
on network and application traffic.
At a data center, you can connect an ION 5200, to
perform the following tasks:
REQUIREMENTS ● Centralize routing and build a network of
● The Control mode makes path selections, security ● Connect to the data center core and WAN edge
private and public WAN paths.
decisions, and prioritizes applications. It also routers.
● Provide a single source of truth for
manages congestion based on ● Inject Prisma SD-WAN branch routes into the core
configuration of ION devices at branch and
controller-programmed policies, reports router to become the preferred next hop to
data center sites.
application and network performance statistics to guarantee path symmetry.
● Utilize a centralized point of administration
the controller. ● Identify traffic sourced from or destined to Prisma
for a security policy rules as well as
application and network analytics. SD-WAN branches, which ensures seamless,
● Enable secure automated virtual private non-disruptive integration between SD-WAN and
network (VPN) tunnels using a zero-touch non-SD-WAN branches.
configuration process.

* MINIMUM ASC LAB REQUIREMENTS IS 1000 OR HIGHER ** MINIMUM ASC LAB REQUIREMENTS IS 9000 OR HIGHER

Product Model Quantity Part Name Description

SKUs
RECOMMENDATIONS Prisma SD-WAN CloudGenix 1 PAN-ION-1200-NFR ION 1200 NFR Unit

Prisma SD-WAN CloudGenix 1 PAN-ION-5200-NFR ION 5200 NFR Unit

Prisma SD-WAN CloudGenix 1 PAN-ION-SUB-DC-NFR ION DC NFR (Data Center Subscription)

* For more details, check Get Started with SD-WAN

© 2023 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.
 CORTEX

© 2023 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.
 CORTEX XDR IS COMPRISED OF THE FOLLOWING COMPONENTS*

CORTEX CORTEX XDR

WEB INTERFACE
CORTEX
XDR AGENTS
PALO ALTO NETWORKS
CLOUD-DELIVERED SECURITY SERVICES

XDR * FOR MORE DETAILS CHECK THE CORTEX XDR ADMINISTRATOR GUIDE
CORTEX DATA LAKE DIRECTORY SYNC SERVICE WILDFIRE CLOUD SERVICE

LAB PLAN YOUR DEPLOYMENT

REQUIREMENTS (Cortex XDR Pro per Endpoint
Determine the amount of log Determine the region in which Review Where can I install the When you are
storage you need for your you want to host Cortex XDR Cortex XDR agent for license only) Calculate the ready to get
Cortex XDR deployment. Talk and any associated services, supported operating systems bandwidth required to support the started with a
number of agents you plan to
to your Partner or Sales such as Directory Sync Service and versions. new tenant,
deploy. You need 1.2Mbps of
Representative to determine Activate.
bandwidth for every 1,000 agents.
whether you must purchase NOTE: If you plan to stream The bandwidth requirement scales
additional storage within the data from a Cortex Data Lake linearly so, for example, to support
Cortex XDR tenant. instance, it must be in the 100,000 agents, you need to
same region as Cortex XDR. allocate 120 Mbps of bandwidth.

Product Model Quantity Part Name Description

SKUs
RECOMMENDATIONS Cortex XDR Cortex-XDR 200 (license) PAN-XDR-ADV-EP-NFR Not For Resale, Cortex XDR Pro per endpoint

Cortex XDR Cortex-XDR 1 PAN-XDR-PRO-GB-NFR Not For Resale, Cortex XDR Pro per GB/day

Not For Resale, Cloud host protection for Cortex

Cortex XDR Cortex-XDR 100 PAN-XDR-ADV-EP-CLOUD-NFR XDR (for a single host), includes 30 days of data
retention

© 2023 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.
 LAB REQUIREMENT FAQ

© 2023 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.
Partner Services | Frequently Asked Questions

➔ When will these requirements come into effect? The laboratory requirements will be implemented on
November 1, 2023. Existing Certified Professional Service Providers (CPSPs) will be given until January 31, 2024 to
ensure compliance.

➔ From the effective date, how much time will each partner have to set up the lab before they are considered
non-compliant? Partners are required to set up their laboratories by February 1, 2024

➔ How will the lab requirements be enforced or audited? How often? Does partial compliance count for
anything? The lab requirements will be enforced through yearly audits. Partial compliance will not be counted
towards meeting the lab requirements.

➔ Will a partner be removed from the CPSP listing page if they do not have the lab compliance? Yes, partners
who are not in compliance with the lab requirements may be removed from the CPSP listing page. Their SFDC
status will also be set to “No” and they will be removed from the program.

➔ If a partner is non-compliant due to lab requirements only, will they be removed from the program? Is there
a grace period? Partners who are non-compliant solely due to lab requirements may be subject to removal from
the program.

© 2023 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.
Partner Services | Frequently Asked Questions (con’t)

➔ If a partner is not providing services in a given product family, will they still need to have those lab
requirements? For example, if a partner only deploys Strata, do they need a SASE or Cortex lab? Partners will
need to meet the lab requirements relevant to the services they are providing. If a partner is only deploying Strata,
they will not be required to have a SASE or Cortex lab.

➔ Partners will need to specify the specific product family they will be focusing their services on. This
information will be necessary for auditing purposes and should be shared with the Partner Services Manager. It is
important to note that each product family will have its own certification process.

➔ Will there be hardware discounts given to partners for the lab requirements? The necessary hardware can be
purchased through the Not-For-Resale program, which provides discounts on the required equipment. You can find more
information about the NFR program by clicking the NFR Policy Guide.

➔ How do I get my NFR licenses? To obtain NFR (Not For Resale) licenses, partners can refer to the NFR Policy Guide.

© 2023 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.
Partner Services | Frequently Asked Questions (con’t)

➔ Can a partner use a VM instead of physical hardware for NGFW Lab requirements? No, To ensure
comprehensive testing and comprehension of all scenarios, it is crucial to acquire the necessary physical
hardware.

➔ Do partners need to have 2x lab setup for Prisma Access: Panorama Managed AND Cloud Managed in order
to be compliant with Prisma Access specializations? No, the SKUs will remain unchanged, and the partner has
the flexibility to choose either of the deployment models, or both if necessary.

➔ Do Partners need to buy both Branch ION and Data Center ION to be compliant with Prisma SD-WAN
specializations ? Yes, the ION 9000 can be configured for either a branch or a datacenter, however both are
required to setup the SD-WAN lab. The minimum requirement for compliance is at least one ION 1000 and one
ION 9000.

➔ Can partners utilize the Panorama NFR license from the Strata Lab requirements for the Prisma Access
requirements as well and does it count for both? Yes, Partners have the option to utilize the PRA license in
accordance with NGFW requirements and acquire a data lake license, ensuring their compliance with Prisma
Access Lab.

© 2023 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.
Thank You
paloaltonetworks.com

© 2023 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.