When you onboard mobile users, this release includes the ability to specify one or more locations in a region in order to exclude deployment in all regions. This feature provide more granular control over deployed regions and allows you to exclude regions as required by your policy or industry regulations. You select the locations in the region from locations on a map during the onboarding process.

You can now specify a minimum IP address pool of a /23 subnet (512 addresses) for a single region when you onboard mobile users. The lowered IP pool requirement is useful in proof of concept or evaluation situations when you don’t have a large available block of private IP addresses. After you onboard a single region, you can then onboard additional regions in stages and add more IP address pools for those regions.

Prisma Access includes pre-defined IPSec tunnel profiles for some common third-party IPSec and SD-WAN devices. These profiles expedite and simplify the onboarding of service connections and remote network connections that use one of these devices to terminate the connection.

This Prisma Access release supports Clientless VPN.

Prisma Access allows you to control unsanctioned and employee-owned device access to your network and redirect device traffic to Prisma Access for inspection without putting your network or data at risk. Unsanctioned device access control utilizes SAML redirection by proxy instead of directly exposing the SaaS app on your network, removing all possible vulnerabilities to data exfiltration and malware propagation.

An additional location, Europe (Paris), is added to the list of available locations.

To better accommodate larger networks, additional remote network bandwidth choices of 500 Mbps or 1000 Mbps (1000 Mbps) is added. All existing remote network bandwidth choices are retained.