Configure Service Routes (SCM)

1. Log in to Strata Cloud Manager.
2. Configure an interface to use for the service route.

   • Configure Interfaces
   • (PA-5200 Series Firewalls only) Configure the Auxiliary Interface Settings
3. Select ConfigurationNGFW and Prisma AccessDevice SettingsDevice SetupManagement and select the Configuration Scope where you want to create the service route.

   You can select a folder or firewall from your Folders or select Snippets to configure the service route in a snippet.
4. Config Service Route.

   If you have already configured service routes for some services, the Service Route Settings is labeled as Customized.
5. Configure a service route.

   1. Select Customize.

      If you have already configured service routes, you can quickly configure all services to Use Management Interface for all to restore the default service routes for all services.
   2. Configure the service route for a service.

      • For a Predefined Service

        1. Select IPv4 or IPv6 and click the Service name for which you want to customize the service route.
        2. Select the Source Interface.
           Select Any to make all IP addresses on all interfaces available in the Source Address.
        3. Select the Source Address.
        4. Update.
      • For a Destination Service Route

        1. Select Destination and Add destination service route.
        2. Enter the Destination IP address.
           In this case, if a packet arrives with a destination IP address that matches the configured Destination IP address, then the source IP address of the packet is sent to the Source Address configured in the next step.
        3. Select the Source Interface.
           Select Any to make all IP addresses on all interfaces available in the Source Address.
        4. Select the Source Address.
        5. Add.
        6. Save.

      If the configuration you're trying to save doesn't meet the criteria to pass the compliance check, you'll have the option to remediate the issue or override the warning and save the configuration anyway.

6. Configure a custom service route that the firewall uses to query for User-ID information.
7. Push Config to push your configuration changes.