When allocating Aggregate Bandwidth for a Prisma Access "Remote Network" deployment (connecting 50 branch sites), how is the bandwidth license enforced?

The Prisma Access for Remote Networks license is an aggregate bandwidth pool. This pool is allocated by the administrator to specific compute locations (regions). All remote network connections (branch sites) onboarded to a single compute location share the bandwidth allocated to that location. This model allows individual sites to burst and use more bandwidth when needed, as long as the total usage within that compute location's pool does not exceed the allocated capacity. The enforcement is applied at the regional pool level, not on a per-site basis.

A. The model is a shared pool per region, not a hard cap per individual IPSec tunnel, which allows for flexible bandwidth bursting.
C. Bandwidth is licensed as a pool for the service, not tied to the serial numbers of the CPE devices at the branch sites.
D. Bandwidth usage is continuously monitored and enforced against the allocated pool for each compute location, not just checked once at onboarding.

1. Palo Alto Networks. (2023). Prisma Access Administrator’s Guide. "Prisma Access Licensing". In the section "Remote Network Bandwidth," it states: "Prisma Access for Remote Networks uses a bandwidth-based license that you purchase as a pool of bandwidth. You allocate this bandwidth pool to remote network connections in any of the Prisma Access locations where you have onboarded remote networks."

2. Palo Alto Networks. (2023). Prisma Access Administrator’s Guide. "Allocate Bandwidth for Remote Network Connections". This section details the process and clarifies the model: "The bandwidth you allocate to a compute location is shared between all of the remote network connections in that compute location... For example, if you allocate 1Gbps to a compute location and have two remote network connections in that location, the two connections share the 1Gbps of bandwidth."