Identified - Customer Impact : Users operating the latest release of Google Chrome (Build 80.0.3987.132 and later) might experience accessibility issues with MineMeld due to recent changes to SameSite standards for handling cookies in the browser. Please note that the Chrome SameSite update is part of a controlled rollout; as a result, only users who receive this specific update will be affected, though it is expected that all users will be affected as the rollout continues.
We are working hard to resolve this issue. Please stay tuned for more updates.
Mar 26, 15:57 UTC

Monitoring - To promote public health during the COVID-19 outbreak and reduce unnecessary exposure to risk, you may have elected to support your workforce to work from home. If you have a large number of employees working remotely, Prisma Access for Mobile Users provides a scalable way for your remote workers to securely access your organization’s applications and resources - both cloud-based and on-site.

When a large number of mobile users concurrently access a Prisma Access location, Prisma Access detects the increase in mobile users and adds a gateway to accommodate the additional users and enable a steady, predictable performance (also known as an auto-scale event). If you expect that a large number of users will be accessing Prisma Access, Palo Alto Networks recommends the following best practices:

- Make sure that your mobile user IP address pool is sufficient. As a guideline, verify that you have 1.5 times more IP addresses in the pool than the number of user devices that will connect to Prisma Access. This over-allocation ensures that enough IP addresses are available for auto-scale events. If you cannot allocate a sufficiently large IP address pool, contact Palo Alto Networks support to review an alternate design, which may include deploying a NAT policy in your data center.

- Proactively whitelist both the active and reserved gateway and portal IP addresses, so that your users do not lose any connectivity, if you whitelist Prisma Access IP addresses on your network.

To whitelist the gateway and portal IP addresses, run the API script and run commands with a serviceType of gp_gateway and gp_portal and an addrType of active (to get the currently-active gateway and portal addresses) and reserved (to get the IP addresses that are held in reserve for activation on a scaling event).

You can also set up a mechanism to be notified of IP address changes when Prisma Access auto-scales to support the increase in demand. If you have a script running on a web server that can process HTTP Post Notifications, add an IP Change Event Notification URL so that you are notified of changes to IP addresses. You can then re-run the API script to retrieve the new addresses, on-demand.

- Exclude video traffic, which uses high bandwidth and is a low security risk, from being sent to Prisma Access. GlobalProtect provides several configuration options to exclude video streaming traffic from being tunneled to Prisma Access. This configuration ensures prioritization of traffic for business critical applications. The following are some examples for video traffic exclusion:
-- Lower-risk video streaming applications such as YouTube or Netflix
-- Low-risk client applications such as Zoom
-- Traffic destined to a specified domain name
Mar 13, 19:58 UTC

Update - This process will be completed by the end of January.
Jan 11, 01:33 UTC

Update - We are continuing to work on a fix for this issue.
Jan 11, 01:30 UTC

Update - We are continuing to work on a fix for this issue.
Sep 18, 21:44 UTC

Identified - Starting October 31, 2019, Prisma Access requires a minimum Panorama version of PAN-OS 9.0.3-H3. This upgrade is mandatory and is required to support new future Prisma Access releases. We are sending this announcement in advance to allow you time to plan and prepare the upgrade process for your organization.

There are no known issues in Panorama 9.0.3-H3 that affects Prisma Access. We have several Prisma Access customers who have successfully upgraded to Panorama 9.0.x.

No Cloud Services plugin upgrade is required as a part of the Panorama upgrade; Panorama 9.0 is already supported with the Cloud Services plugin. https://docs.paloaltonetworks.com/compatibility-matrix/panorama/plugins.html#id17C8A0Y0M9I

Upgrading your Panorama to 9.0.3-H3 does not give you access to any new PAN-OS 9.0 features in Prisma Access yet; new feature availability will be communicated when it is available.

After October 31, 2019, you will not be able to manage Prisma Access using Panorama versions earlier than 9.0.

If you have additional questions, please contact your Palo Alto Networks representative.

Note: An upgrade to a minimum PAN-OS version of 9.0.3-h3 is required for the upcoming version of Prisma Access (1.5). For more information, see the Palo Alto Networks Live article at Prisma Access 1.5 Action Required
Sep 18, 15:24 UTC