Predictika · Palo Alto Networks platformization

An AI agent's platformization plan, checked before it is committed

An SE, a partner or an AI agent proposes a migration plan for a customer moving to the Palo Alto Networks network security platform: the PAN-OS release for the firewalls, the Panorama release, firewall onboarding prerequisites, Strata Logging Service and its region, Prisma Access users and sites with their licenses, and when the legacy VPN is retired. Before the plan is committed, it goes to the Predictika validator. It computes the remote-network bandwidth the plan needs, compares it with the licensed bandwidth and with the figure the proposal states, checks the onboarding, Panorama release and region rules Palo Alto Networks documents, and returns every reason in one answer. Hard rules block; license shortfalls route to a person. This checks that a plan is valid, not how it performs, and nothing is priced. This is an illustrative model built from Palo Alto Networks' public documentation. Palo Alto Networks is not involved with it and has not endorsed it.

Scope: Moving PA-Series and VM-Series firewalls to Strata Cloud Manager and adding Prisma Access, with or without Panorama. See everything this validator covers

This validator checks one kind of proposal: the migration plan for moving a customer's PA-Series and VM-Series firewalls to Strata Cloud Manager and adding Prisma Access, as described in Palo Alto Networks' public documentation. It handles any plan that picks from these releases, regions and license counts, not only the scenarios on this page. It does not size performance or price, and it does not cover Cortex, Prisma Cloud or individual security policies.

  • Covered: firewall onboarding — PAN-OS 10.2.3 or later, single-vsys firewalls, a device certificate installed, and a Strata Logging Service license.
  • Covered: Panorama — Panorama must be on the same or a later feature release than the firewalls it manages (11.1.4 can manage 11.1.6 but not 11.2), and Panorama-managed firewalls need the CloudConnector plugin to appear in Strata Cloud Manager.
  • Covered: Prisma Access — Strata Logging Service and Prisma Access in the same region; a mobile user is one license unit and remote-network bandwidth is licensed by the Mbps. The need is recomputed from the sites and compared with the licensed amount and with the figure the proposal states. A licensing shortfall goes to a person.
  • Covered: the customer's sequencing policy — here, that the legacy VPN is retired only after the Prisma Access cutover is validated. This is the fictional customer's rule, not a Palo Alto Networks rule.
  • Not covered — performance, price, policy content, other Palo Alto Networks products and releases not in the catalog. Other areas can be added.
  • Only stated rules are modeled — where the documents are silent, the validator does not check.
The AI migration agentProposes the platformization plan from the customer's requirements and says it is ready to commit.
Predictika validatorChecks every rule at once and returns the verdict, each finding, and the computed figures.

8 scenarios in 4 groups · each group runs from the agent’s first attempt to the outcome · click one to switch

What the agent proposes

The AI migration agent says

Illustrative agent statement. The validator receives the structured request below.

Proposing agent: AI migration agent (scripted)

Before sending, the agent must call Recorded run

Predictika validator


      

        
        
        
      

      
Waiting for the call.

      
    

  

  
  

    
Where rules-based CPQ gets it wrong
Click to expand
    
Our assessment of what a typical rules-based CPQ (product rules, price rules and validation rules, as in Salesforce CPQ) does with the same cases. It is a judgment about effort and reliability, not a claim that nothing can be built.

    
What the validator caughtTypical rules-based CPQPredictika
Firewalls, Panorama, regions and stated bandwidth that must all line upOnly with workarounds
Firewall onboarding needs a minimum PAN-OS release, single-vsys firewalls, a device certificate and a logging license, and Panorama must be on the same or a later feature release than the firewalls it manages. Each is simple alone; a configurator checks products and licenses, not the plan.		All of them are checked together on every call, and each failure comes back with the number or release that caused it.
Logging and Prisma Access in different regionsOnly with care
Strata Logging Service and Prisma Access must be in the same region for Strata Cloud Manager deployments. A quote can list both products and still put them in different regions.		The two regions are compared on every call and the block names both.
Stated bandwidth against the bandwidth the sites needOnly with workarounds
Remote-network bandwidth is sites times Mbps per site, and the proposal states its own total. Quoting tools carry the stated figure; they do not recompute it from the sites.		The need is recomputed from the sites, compared with the stated figure and with the licensed Mbps, and a shortfall goes to a person rather than blocking.
Legacy VPN retired too early: the customer's own sequencing policyOnly with workarounds
The rule that the legacy VPN is retired only after the cutover is the customer's, not a product rule. It lives in a runbook, not in the quote.		The policy travels with the plan and is checked on every call, and it is labeled as policy, not as a Palo Alto Networks rule.

  

  

    
What this validator catches: findings from its test cases
Click to expand
    
Every rule is checked on every call, in any order the choices arrive; one problem never hides another. Blocking findings stop the plan; approval findings need a person to sign off; everything else is computed. The wording shown is an example from the test runs; the numbers change with the proposal.

    
1Device certificate missing (blocks): The device certificate must be installed on each firewall before it is onboarded to Strata Cloud Manager; the plan has firewalls without it.
2Legacy VPN retired too early (blocks): Customer policy: the legacy VPN is retired only after the Prisma Access cutover is validated; the plan retires it first.
3Logging and Prisma Access in different regions (blocks): For Strata Cloud Manager deployments, Strata Logging Service and Prisma Access must be in the same region; the plan has logging in the Europe region and Prisma Access in the US region.
4Multi-vsys firewalls (blocks): Strata Cloud Manager onboarding supports single-vsys firewalls only; the plan includes multi-vsys firewalls.
5No Strata Logging Service license (blocks): Strata Logging Service is required for onboarding firewalls and for Prisma Access logs; the plan has no Strata Logging Service license.
6PAN-OS below 10.2.3 (blocks): Firewalls must run PAN-OS 10.2.3 or later to be onboarded to Strata Cloud Manager; the plan targets PAN-OS 10.2.2.
7Panorama older than the firewalls (blocks): Panorama on PAN-OS 11.1.4 cannot manage firewalls on a later feature release; the plan puts the firewalls on PAN-OS 11.2.4. Upgrade Panorama first.
8Panorama plugin missing (blocks): Panorama-managed firewalls are visible in Strata Cloud Manager only through the Panorama CloudConnector plugin, which the plan does not install.
9Stated bandwidth does not match (blocks): Stated remote-network bandwidth does not match: the agent stated 18000 Mbps; the validator computes 12000 Mbps (120 sites x 100 Mbps).
10Licensed bandwidth below the plan (needs approval): Licensed remote-network bandwidth (6000 Mbps) is below the 7500 Mbps the plan needs; confirm the license before the cutover.
11Licensed mobile users below the plan (needs approval): Licensed Prisma Access mobile users (2400) are fewer than the users in the plan (3100); confirm the license with Palo Alto Networks before the cutover.

  

  

    
Scenarios and results
Click to expand
    
The recorded result of the validator for each scenario on this page: the request the AI agent sent, the verdict, and every finding, in the order they appear above.

    
1. Migration plan (Northgate Freight): Firewalls to 11.2.4 under Panorama 11.1.4, multi-vsys, mismatched regions, a stated 18,000 Mbps

    
The agent's request. Please check the platformization plan for Northgate Freight: firewalls moving to PAN-OS 11.2.4 under Panorama on PAN-OS 11.1.4, 9,000 mobile users and 120 remote-network sites at 100 Mbps each, stated as 18,000 Mbps of remote-network bandwidth, with logging in Europe and Prisma Access in the US. It is ready to commit.

    
Verdict: Blocked.

    
    
      
  • Multi-vsys firewalls. Strata Cloud Manager onboarding supports single-vsys firewalls only; the plan includes multi-vsys firewalls.
    • 
      
  • Logging and Prisma Access in different regions. For Strata Cloud Manager deployments, Strata Logging Service and Prisma Access must be in the same region; the plan has logging in the Europe region and Prisma Access in the US region.
    • 
      
  • Panorama older than the firewalls. Panorama on PAN-OS 11.1.4 cannot manage firewalls on a later feature release; the plan puts the firewalls on PAN-OS 11.2.4. Upgrade Panorama first.
    • 
      
  • Stated bandwidth does not match. Stated remote-network bandwidth does not match: the agent stated 18000 Mbps; the validator computes 12000 Mbps (120 sites x 100 Mbps).
    • 
      
  • Legacy VPN retired too early. Customer policy: the legacy VPN is retired only after the Prisma Access cutover is validated; the plan retires it first.
    • 
    

    
2. Migration plan (Northgate Freight): Panorama upgraded and bandwidth restated; region and VPN order still wrong

    
The agent's request. Please check the platformization plan for Northgate Freight: firewalls moving to PAN-OS 11.2.4 under Panorama on PAN-OS 11.2.4, 9,000 mobile users and 120 remote-network sites at 100 Mbps each, stated as 12,000 Mbps of remote-network bandwidth, with logging in Europe and Prisma Access in the US. It is ready to commit.

    
Verdict: Blocked.

    
    
      
  • Logging and Prisma Access in different regions. For Strata Cloud Manager deployments, Strata Logging Service and Prisma Access must be in the same region; the plan has logging in the Europe region and Prisma Access in the US region.
    • 
      
  • Legacy VPN retired too early. Customer policy: the legacy VPN is retired only after the Prisma Access cutover is validated; the plan retires it first.
    • 
    

    
3. Migration plan (Northgate Freight): Logging moved to the US and the VPN retired after cutover

    
The agent's request. Please check the platformization plan for Northgate Freight: firewalls moving to PAN-OS 11.2.4 under Panorama on PAN-OS 11.2.4, 9,000 mobile users and 120 remote-network sites at 100 Mbps each, stated as 12,000 Mbps of remote-network bandwidth, with logging in the US and Prisma Access in the US. It is ready to commit.

    
Verdict: Allowed.

    
4. Firewall onboarding: PAN-OS 10.2.2, no device certificates, no logging license

    
The agent's request. Please check the platformization plan for Alder Health Partners: firewalls moving to PAN-OS 10.2.2 under Panorama on PAN-OS 10.2.2, 2,600 mobile users and 18 remote-network sites at 200 Mbps each, stated as 3,600 Mbps of remote-network bandwidth, with logging in the US and Prisma Access in the US. It is ready to commit.

    
Verdict: Blocked.

    
    
      
  • PAN-OS below 10.2.3. Firewalls must run PAN-OS 10.2.3 or later to be onboarded to Strata Cloud Manager; the plan targets PAN-OS 10.2.2.
    • 
      
  • Device certificate missing. The device certificate must be installed on each firewall before it is onboarded to Strata Cloud Manager; the plan has firewalls without it.
    • 
      
  • No Strata Logging Service license. Strata Logging Service is required for onboarding firewalls and for Prisma Access logs; the plan has no Strata Logging Service license.
    • 
    

    
5. Firewall onboarding: 10.2.10, certificates installed, logging licensed in region

    
The agent's request. Please check the platformization plan for Alder Health Partners: firewalls moving to PAN-OS 10.2.10 under Panorama on PAN-OS 10.2.10, 2,600 mobile users and 18 remote-network sites at 200 Mbps each, stated as 3,600 Mbps of remote-network bandwidth, with logging in the US and Prisma Access in the US. It is ready to commit.

    
Verdict: Allowed.

    
6. Panorama release train: Firewalls on 11.2.4 under Panorama 11.1.4, no plugin

    
The agent's request. Please check the platformization plan for Corvid Manufacturing: firewalls moving to PAN-OS 11.2.4 under Panorama on PAN-OS 11.1.4, 1,800 mobile users and 25 remote-network sites at 80 Mbps each, stated as 2,000 Mbps of remote-network bandwidth, with logging in the US and Prisma Access in the US. It is ready to commit.

    
Verdict: Blocked.

    
    
      
  • Panorama older than the firewalls. Panorama on PAN-OS 11.1.4 cannot manage firewalls on a later feature release; the plan puts the firewalls on PAN-OS 11.2.4. Upgrade Panorama first.
    • 
      
  • Panorama plugin missing. Panorama-managed firewalls are visible in Strata Cloud Manager only through the Panorama CloudConnector plugin, which the plan does not install.
    • 
    

    
7. Panorama release train: Panorama on 11.2.4 with the plugin installed

    
The agent's request. Please check the platformization plan for Corvid Manufacturing: firewalls moving to PAN-OS 11.2.4 under Panorama on PAN-OS 11.2.4, 1,800 mobile users and 25 remote-network sites at 80 Mbps each, stated as 2,000 Mbps of remote-network bandwidth, with logging in the US and Prisma Access in the US. It is ready to commit.

    
Verdict: Allowed.

    
8. License headroom: Licensed users and bandwidth below the plan

    
The agent's request. Please check the platformization plan for Kestrel Foods: firewalls moving to PAN-OS 11.1.6 under Panorama on PAN-OS 11.1.6, 3,100 mobile users and 50 remote-network sites at 150 Mbps each, stated as 7,500 Mbps of remote-network bandwidth, with logging in the US and Prisma Access in the US. It is ready to commit.

    
Verdict: Needs approval.

    
    
      
  • Licensed mobile users below the plan. Licensed Prisma Access mobile users (2400) are fewer than the users in the plan (3100); confirm the license with Palo Alto Networks before the cutover.
    • 
      
  • Licensed bandwidth below the plan. Licensed remote-network bandwidth (6000 Mbps) is below the 7500 Mbps the plan needs; confirm the license before the cutover.
    • 
    

  

  

    
Narration transcript
Click to expand
    
The text of the narrated walkthrough, step by step.

    
    
      
  1. Welcome to a demo of Predictika's Validator. An SE, a partner or an AI agent proposes a migration plan for a customer moving to the Palo Alto Networks network security platform: the PAN-OS release for the firewalls, the Panorama release, firewall onboarding prerequisites, and more. Before the plan is committed, it goes to the Predictika validator. It computes the remote-network bandwidth the plan needs, compares it with the licensed bandwidth and with the figure the proposal states, checks the onboarding, Panorama release and region rules Palo Alto Networks documents, and returns every reason in one answer. Hard rules block; license shortfalls route to a person. This checks that a plan is valid, not how it performs, and nothing is priced. This is an illustrative model built from Palo Alto Networks' public documentation. Palo Alto Networks is not involved with it and has not endorsed it.
    2. 
      
  2. I will start with the first request by the agent.
    3. 
      
  3. The agent says. Please check the platformization plan for Northgate Freight: firewalls moving to PAN-OS 11.2.4 under Panorama on PAN-OS 11.1.4, 9,000 mobile users and 120 remote-network sites at 100 Mbps each. It is ready to commit. The rest of the request is on screen.
    4. 
      
  4. Before it goes out, the agent calls the validator.
    5. 
      
  5. Blocked, with five findings, all in one answer. Strata Cloud Manager onboarding supports single-vsys firewalls only; the plan includes multi-vsys firewalls. For Strata Cloud Manager deployments, Strata Logging Service and Prisma Access must be in the same region; the plan has logging in the Europe region and Prisma Access in the US region. Panorama on PAN-OS 11.1.4 cannot manage firewalls on a later feature release; the plan puts the firewalls on PAN-OS 11.2.4. Upgrade Panorama first. The other two are on screen.
    6. 
      
  6. The validator returned five blocking findings in one answer. A check that reads one field at a time would pass most of this; it shows only when the choices in the action plan are checked against each other.
    7. 
      
  7. What this shows: for firewalls, Panorama, regions and stated bandwidth that must all line up, a rules-based application can do this only with workarounds.
    8. 
      
  8. Now the agent resubmits.
    9. 
      
  9. The corrected request. It changes the management server release to PAN-OS 11.2.4, the firewall virtual systems to single vsys and the stated bandwidth to 12,000 Mbps.
    10. 
      
  10. It calls the validator again.
    11. 
      
  11. Still blocked, with two findings, all in one answer. For Strata Cloud Manager deployments, Strata Logging Service and Prisma Access must be in the same region; the plan has logging in the Europe region and Prisma Access in the US region. Customer policy: the legacy VPN is retired only after the Prisma Access cutover is validated; the plan retires it first.
    12. 
      
  12. Three findings cleared. Still blocking: logging and Prisma Access in different regions and legacy VPN retired too early.
    13. 
      
  13. The agent resubmits once more.
    14. 
      
  14. The revised request. It changes the logging region to US and the VPN retirement to Retired after the Prisma Access cutover.
    15. 
      
  15. It calls the validator once more.
    16. 
      
  16. This time the validator clears it.
    17. 
      
  17. The validator also returns the line-item quote. It starts with PAN-OS 11.2.4 and Mobile users; the other two lines are on screen.
    18. 
      
  18. Both earlier findings are cleared, and the validator's figure matches the action plan.
    19. 
      
  19. Five problems caught in one call, fixed in two passes, and a clean action plan. That is the value of Predictika's validator: catching mistakes before the plan runs. Now you can try the other scenarios yourself.
    20.