Strata Cloud Manager

1. Create one or more APN or DNN profiles.

   1. Select ConfigurationNGFW and Prisma Access and choose the Configuration Scope that contains your firewalls, select Network & DeviceNetwork ProfilesAPN/DNN Profile.

   2. Add.

   3. For Network Type, choose APN or DNN.
   4. Enter a Name for the profile.
   5. Select an Authentication Type: PAP, CHAP, or Auto.
   6. Enter the APN/DNN Name as your carrier provides it.
   7. Select a PDP Type: IPv4, IPv6, or Both. If your carrier requires authentication, enter the Username and Password, and then confirm the password.
   8. If you selected DNN Network Type, select the DNN profile that maps to a 5G network slice, enter the Network Slice (SST) value (0–255) and, if your carrier requires it, the Network Slice (SD) value (0–16777215).
   9. Click Add, and repeat for each additional profile.
2. Select Network & DeviceInterfacesCellular and select the cellular interface that you want to configure, or click Add Cellular to create one.
3. On the Interface tab, assign the primary APN or DNN profile to each SIM slot that you use.

   1. Under SIM Settings, select the SIM Slot 1 or SIM Slot 2 tab.
   2. For APN/DNN Profile, select the profile that you created. The default is None (Auto).
4. Add a cellular subinterface for each additional APN or DNN session.

   1. Under SIM Settings, select the SIM Slot 1 or SIM Slot 2 tab that carries the session, and then click Add Sub Interface.

      Each SIM slot tab has its own Sub Interfaces list, which shows the Interface Name and Profile of each subinterface.
   2. In General, complete the Interface Name by selecting the unit number from the drop-down.

      The subinterface name is the name of the parent interface followed by the unit number. Units 1 through 7 use SIM slot 1, and units 8 through 14 use SIM slot 2.
   3. (Optional) Enter a Comment, and select a Netflow Profile or click Create New.
   4. For APN/DNN Profile, select the profile for this session or click Create New.

      This field is required.
   5. Under Assign Interfaces To, select a Logical Routers or Virtual Router option, and select a Zone or click Create New.

      Assign each subinterface its own zone to apply a different security policy to each session.
   6. Under IP Address, configure the IPv4 and, if needed, IPv6 settings.

      On the IPv4 tab, Automatically create default route is selected by default, and the Default Route Metric is 10.
   7. (Optional) Expand Advanced Settings to configure additional subinterface settings.
   8. Click Add, and repeat for each additional session.

      The subinterface appears in the Sub Interfaces list, and under its parent on the Cellular page.
5. Configure policy-based forwarding (PBF) rules to steer traffic to the appropriate subinterface based on source address, destination address, port, or application.
6. Select Push Config and push the configuration to your firewalls.

   A reboot is not required.
7. Verify that the sessions are active.

   On the firewall, run:

   show cellular session detail