To inspect SaaS app traffic (often encrypted), you must configure:
SSL Forward Proxy
The SSL Forward Proxy decryption profile enables the firewall to decrypt outbound SSL traffic, essential for visibility into SaaS app usage.
Validate certificates
Validating and deploying the appropriate root and intermediate CA certificates is critical for establishing trust and preventing SSL errors during decryption.
Without these steps, SaaS decryption and policy enforcement would be incomplete.

Prisma Access is designed with mechanisms that allow upgrades to be performed without impacting network traffic or service availability, specifically leveraging phased, resilient upgrade processes with built-in failover and redundancy to guarantee continuous operation during upgrades. Disabling policies, backup-based deployment, and multi-phase firmware staging are not unique to Prisma Access's seamless upgrade capabilities.

Device grouping rules in SCM allow administrators to organize firewalls into logical groups and collectively manage updates or configuration pushes across those groups.
SCM allows you to create device group rules, enabling streamlined management and collective updates of multiple NGFW instances.
This approach ensures consistency in software versions and configuration baselines across large deployments.

Single floating IP address (also known as a floating IP or shared IP) is supported only in an active/passive HA pair. In active/active HA, both firewalls are forwarding traffic simultaneously and thus do not share a single floating IP.
In active/passive HA, a single floating IP address is used for seamless failover. Active/active HA requires separate IP addresses and does not support a single floating IP.
This simplifies failover in active/passive deployments by using a single shared IP that moves to the active peer upon failover.

To minimize disruptions, it is recommended to perform Prisma Access upgrades during non- business hours and in a phased manner, starting with less critical sites to validate the process before moving to critical locations. Backup configurations and validate the system's readiness to avoid data loss and maintain service continuity.