The following figure provides an example of Clean Pipes configured for a single tenant, with multiple Clean Pipes configured for the tenant.

In this example, the service provider manages the internet connectivity for four organizations and wants to protect outbound internet access for them. The service provider creates a Google Cloud Platform (GCP) Partner Interconnect and creates a VLAN attachment for each tenant. The service provider configures Prisma Access for Clean Pipe using Panorama to create security for the VLAN attachment.

This example shows a single Clean Pipe per tenant. You can also create multiple Clean Pipes in a single tenant. Make sure that each Clean Pipe you specify for a tenant uses a different location.

The following figure shows a single Clean Pipe in more detail for a tenant who wants a clean connection to the internet. The Customer Edge (CE) router provides WAN connectivity for the tenant. The CE router connects to a cloud router, and the cloud router provides connectivity for the Partner Interconnect. The service provider creates a VLAN attachment for the tenant, and configures Prisma Access for Clean Pipe in Panorama to provide security for the VLAN attachment, which protects the tenant’s internet-based traffic.