Prisma SD-WAN

Licensing Guide

Prisma by Palo Alto Networks | Prisma SD-WAN Licensing Guide | Datasheet 1

Prisma SD-WAN Licensing Overview
SD-WAN Appliances
The Prisma SD-WAN Instant-On Network (ION) models of hardware and software devices enable in-
tegration of a diverse set of WAN connection types, the cloud-delivered branch, improved application
performance and visibility, and reduce the overall cost and complexity of your WAN. Customers may
purchase ION devices for branch or data center sites.

Base Subscription Licenses

A software subscription must be associated with each ION device deployed. All software subscriptions
have a minimum term of one year and a maximum term of five years.

Data Center Subscription

A data center (DC) subscription can be attached to an ION 3000, ION 3200, ION 5200, ION 9000, ION
9200, a virtual ION 3108, or a virtual ION 7108 model. It includes the feature set required for DC deploy-
ments and unlimited bandwidth (up to the device throughput specification limit as published in the
datasheet and updated for every software release).

Branch Subscription
Branch subscriptions can be licensed by bandwidth tier (device-based) or as bandwidth on demand
(aggregate bandwidth).

Branch Subscription (Device-Based)

For device-based branch subscription orders, a branch subscription license must be purchased for each
ION device deployed. For a high availability (HA) pair, one license is required per device in the HA pair.
Available options for device-based branch subscriptions include 25 Mbps, 50 Mbps, 150 Mbps, 250
Mbps, 500 Mbps, 1 Gbps, and 2.5 Gbps as shown in the following table.

Table 1: Device-Based Branch Subscription

Platform Bandwidth Tier Options

ION 1000 25 Mbps, 50 Mbps

ION 1200 25 Mbps, 50 Mbps, 150 Mbps, 250 Mbps

ION 1200-S 25 Mbps, 50 Mbps, 150 Mbps, 250 Mbps

ION 2000 25 Mbps, 50 Mbps, 150 Mbps, 250 Mbps

ION 3000 25 Mbps, 50 Mbps, 150 Mbps, 250 Mbps, 500 Mbps

ION 3200 25 Mbps, 50 Mbps, 150 Mbps, 250 Mbps, 500 Mbps

ION 5200 25 Mbps, 50 Mbps, 150 Mbps, 250 Mbps, 500 Mbps, 1 Gbps

ION 9000 25 Mbps, 50 Mbps, 150 Mbps, 250 Mbps, 500 Mbps, 1 Gbps, 2.5 Gbps

ION 9200 25 Mbps, 50 Mbps, 150 Mbps, 250 Mbps, 500 Mbps, 1 Gbps, 2.5Gbps

Sizing guidance for the selection of a subscription tier is based upon expected “typical” usage at a site
level. Bandwidth tiers should be selected based on the total aggregate bandwidth (ingress + egress)
passing through the ION appliance from LAN to WAN based on the device’s capabilities.
Periodic bursts of traffic may occur in the network that exceed a specific bandwidth subscription tier.
The bandwidth subscription limit is currently not enforced by the product (e.g., if you buy a 50 Mbps
license for an ION 2000 which is capable of handling 250 Mbps of throughput, the device will NOT be
capped at 50 Mbps). Palo Alto Networks reserves the right to add license monitoring and enforcement
in the future for new bandwidth subscription purchases and renewals.

Prisma by Palo Alto Networks | Prisma SD-WAN Licensing Guide | Datasheet 2

Optional Subscription Licenses
There are three optional software licenses that can be added per physical or virtual device that will be
deployed with a Branch Bandwidth subscription, when purchased as bandwidth tier (device-based).
Just like the base subscriptions, these licenses have a minimum term of one year and a maximum term
of five years.
• Zone-Based Firewall (ZBFW) subscription: Application firewall
• WAN Clarity Network DVR subscription: Data retention and visibility beyond the default seven days
• WAN Clarity Reporting (WCR) subscription: AIOps capabilities and system-generated reports

Notes
• Clarity Network DVR and WAN Clarity Reporting are features which are enabled at the tenant (cus-
tomer) level. They must be purchased for every branch device. As such, if an existing customer has
previously purchased Clarity Network DVR, they must purchase Clarity Network DVR for all branch
devices in this new order.
• There are NO options to selectively have Clarity Network DVR and WAN Clarity Reporting for some
branch sites but not others.
• The zone-based firewall can be purchased on a per device basis, applicable for branch site only. Zone-
based firewalls cannot be enabled on a data center site.
• For the bandwidth on demand-based subscription, the ZBFW, Clarity Network DVR and WAN Clarity
Reporting subscriptions are already incorporated.

Branch Subscription (Bandwidth Licensing On Demand)

Applicable to any ION device that will be deployed at a branch site, you can purchase bandwidth on an
aggregate basis (in 1 Mbps increments) based on the total estimated bandwidth needed across all devic-
es (physical and virtual) across all branch locations, including HA scenarios. Bandwidth Licensing On
Demand includes DVR, WCR, and ZBFW as part of the list price.
To ensure optimized performance, this on-demand consumption model enables organizations to burst
capacity above licensed amounts, eliminating issues due to spikes in bandwidth demand. Prisma SD-
WAN captures bandwidth utilization metrics from any branch-deployed device on an ongoing basis.
Palo Alto Networks will analyze bandwidth utilization for all branch devices deployed across any tenant
on a regular basis and may use this data for planning purposes and to recommend future license upgrades
for customers during a renewal period. If bandwidth utilization during the term period exceeds 120% of
annually purchased bandwidth, the customer is required to purchase additional branch bandwidth.

Branch Dimensioning Considerations for Bandwidth Licensing On-Demand Subscriptions

Determining the bandwidth on-demand quantity for a customer quote should be part of the initial op-
portunity sizing exercise, taking into account factors, such as the number of branch sites, the number
of users per site and in total, and traffic utilization patterns (such as, busy hour traffic, hybrid work
patterns, typical apps used, etc.). The following are some general rules of thumb to determine best fit
for the amount of aggregate bandwidth to purchase:
• If you know the total WAN bandwidth required at each branch site, use this information to determine
the aggregate bandwidth across all branches.
• If existing technology and tools are in place to determine utilization, use this information to calculate
a normalized value over at least a one-month period, factoring in location work hours/days, active
users, peak usage periods, etc.
• Base assumption should be that the minimum average bandwidth across all branch devices would
equate to at least 10 Mbps.

Prisma by Palo Alto Networks | Prisma SD-WAN Licensing Guide | Datasheet 3

Bandwidth Utilization Measurement and Reporting
• All devices report ingress and egress bytes passing through the ION appliance on all WAN circuits
(LAN to WAN and WAN to LAN).
• Sustained utilization values are calculated per device every five minutes by averaging per-minute
samples to eliminate any instantaneous traffic bursts and throughput spikes.
• The monthly utilization is then calculated as the aggregate of maximum sustained utilization values
across all devices in the customer tenant during that month.
• If the monthly utilization exceeds 120% of the aggregate amount of bandwidth licensed, Palo Alto
Networks reserves the option to charge for the required additional bandwidth on a “true forward”
prospective basis. Palo Alto Networks will discuss the additional bandwidth and resulting fees during
the next business review, as applicable. This allows customers to plan and budget for future con-
sumption growth.

3000 Tannery Way © 2023 Palo Alto Networks, Inc. Palo Alto Networks is a registered ­
Santa Clara, CA 95054 trademark of Palo Alto Networks, Inc. A list of our trademarks can be found
at https://www.paloaltonetworks.com/company/trademarks.html. All other
Main: +1.408.753.4000 marks mentioned herein may be trademarks of their respective companies.
Sales: +1.866.320.4788 prisma_ds_sd-wan-licensing-guide_031323
Support: +1.866.898.9087

www.paloaltonetworks.com