Activate SaaS Security Inline for NGFW

1. Initiate the SaaS Security Inline activation process based on your license type.

   An ELA (Enterprise Level Activation) license activates all your firewalls. A non-ELA license activates a fixed numbers of firewalls.

   • (non‑ELA license) Open your SaaS Security Inline activation email and click Activate, then log in with your Palo Alto Networks Customer Support Portal account credentials.
     The number of Activate buttons in the email you received depends on what you purchased. Each Activate button launches the same onboarding workflow that lets you activate all your purchased products together. Click any Activate button to begin. Additionally, your activation email depends on the type of activation: purchase, trial, or evaluation.
     It is important to keep the SaaS Security Inline activation email you received from Palo Alto Networks. In addition to containing confidential activation-related data, you will need this email to activate more firewalls later if you still have unused SaaS Security Inline licenses after completing the onboarding process.

   • (ELA license) Log in to the hub with your Palo Alto Networks Customer Support Portal account credentials, then select SaaS Security from the ELA Activations menu on the hub.

   • Log on to Customer Support Portal (CSP) with Super User, Domain Administrator, and ELA Administrator permissions, then navigate to Assets > Enterprise Agreements and click ELA-SaaS Inline Activation.

2. Select the products to activate, then Start Activation.

   If you have multiple items to activate, leave them all selected when you Start Activation.

3. (non-ELA) Select a Customer Support Account, then Next

   If you have more than one Support account, select the one with firewalls to subscribe to SaaS Security Inline.

   This step is not included in the ELA activation process because you begin the process in the Hub and, therefore, your Support account is already known.

4. In SaaS Security Inline Setup, configure SaaS Security Inline.

   • Data Lake and Data Lake Region—You must have an active Strata Logging Service or activate a new one now. Do one of the following:
     • New Strata Logging Service—Select Activate New if you are activating a new Strata Logging Service subscription, then choose its region.
     • Existing Strata Logging Service—Select an existing Strata Logging Service instance to use if you did not purchase a new Strata Logging Service. If you have more than one Strata Logging Service instance, choose the one to which firewalls will forward logs with network traffic metadata.
   • SaaS Tenant, SaaS Region, and SaaS Subdomain—Do one of the following:
     • New Tenant—Select Activate New to create a new SaaS Security Inline tenant, then type a subdomain name, which completes the URL for your SaaS Security Inline app and becomes the URL where you log in to the SaaS Security web interface. SaaS Subdomain is prepopulated with the domain name from your email address, but you can change it if you want.
     • Existing Tenant—Select an existing tenant if you did not purchase a new Strata Logging Service or you don’t want to activate a newly purchased Strata Logging Service. Each SaaS tenant requires a unique Strata Logging Service. You cannot reuse Strata Logging Services. The onboarding process enforces this requirement and automatically populates SaaS Tenant with the SaaS tenant that is mapped to the existing Strata Logging Service. SaaS Region defaults to Strata Logging Service region.
5. Choose the Firewalls to enable for this SaaS Security Inline subscription, then Next.

   • (non-ELA) Select a firewall Model on the left and then select subscriptions for the Serial Number(s) of individual device(s) belonging to that model on the right. Observe how many SaaS Security Inline subscriptions are assigned and still available for the selected model near the top of the page. Track the number of licenses each model will use and how many are still available in the middle of the page.
   • (ELA) Select Serial Number column to select all firewalls up to 200. For each activation session, you can activate a maximum of 200 firewalls. To activate more, repeat the activation process.

   The following tables lists each firewall type that the SaaS Security Inline license types support:

   Firewall types	SaaS Security Inline license types
   	Prod	Eval	Trial	Lab
   Prod (Production)	Yes	No	Yes	No
   Eval (Evaluation)	No	Yes	No	No
   Lab	No	No	Yes	Yes

   When you purchase SaaS Security Inline production subscriptions, the licenses are specific to firewall models. It’s not possible to use licenses created for one model with a different model. On the other hand, when evaluating SaaS Security Inline, Palo Alto Networks provides temporary eval and trial licenses that can be used on any firewall.

   A firewall type—prod, eval, and lab—is defined by the firewall SKU. To see the SKU for a firewall, log in to your Customer Support Portal account and navigate to AssetsDevices and check the entry for the serial number of your firewall in the Model Name column. This is the SKU, which indicates the firewall type as follows:

   • prod SKU—ends with the firewall model name; for example, PAN-PA-200
   • eval SKU—ends with -E30, which stands for Eval + 30 days; for example, PAN-PA-200-E30
   • lab SKU—ends with -LAB; for example, PAN-PA-200-LAB
6. Verify your activation selections, read and agree to the terms and conditions, then Activate Subscription.

   (non‑ELA) To check how many subscriptions will be used and how many remain, hover your cursor over the information icon next to Activate Subscriptions on <number> firewalls. A pop-up panel displays the total number of purchased SaaS Security Inline subscriptions you have, how many will be activated in this session, how many were previously activated, and how many have not yet been chosen for activation.

   Depending upon what you onboard, the activation process creates a URL for your SaaS Security web interface and applies SaaS Security Inline licenses to the selected firewalls and links them to your SaaS Security account. During ACE deployment, your firewall administrator retrieves the license keys from the license server.
7. Verify that your Strata Logging Service serial number displays on the web interface and indicates Monitoring.
8. Navigate to SettingsLicense Info, then verify your SaaS Security Inline license.