Configure Prisma Access Colo-Connect—Deployments Using Dedicated Interconnects

1. Create subnets for your Colo-Connect connections.

   You use the subnets you create here in the connections and service connections that you create in later steps.

   1. From the Panorama that manages Prisma Access, go to PanoramaCloud ServicesConfigurationColo-Connect and click the gear icon to edit the settings.
   2. Add a Colo-Connect Subnet and select a Prisma Access location (PA Location) for it.

      Enter a minimum subnet of /28.
   3. (Optional) If you plan on creating Colo-Connect instances for more than one location, Add more subnets on a per-location basis.

      You can configure only one subnet per location.
   4. Select Create new templates and device-group for Prisma Access Colo-Connect.

      The first time you configure a Colo-Connect deployment, select this check box so that templates and device groups (Colo_Connect_Template and Colo_Connect_Device_Group, respectively) are created for Colo-Connect. After you create these templates and device groups, this check box is grayed out.

2. Add a new Colo-Connect link (also known as the interconnect).

   1. Go to PanoramaCloud ServicesConfigurationColo-ConnectColo Connect Link and Add a Colo-Connect link.
   2. Give the link a unique Link Name.
   3. Select a Dedicated interconnect.
   4. Specify the remaining Colo-Connect link parameters.

      • Select either 10Gbps or 20Gbps for the Bandwidth.
        If you select 20 Gbps, you must aggregate the Dedicated Interconnect link into two 10 Gbps links using LACP.
        You cannot change the bandwidth of a dedicated interconnect link after you specify it and commit and push your changes.
      • Select a Colo-Connect Location from the drop-down list.
        Make sure that you select the same location that you used for the dedicated interconnect.
      • Select either Zone1 or Zone2 for the Edge Availability Domain. Take this value from the GCP zone used for your edge availability domain.
      • Enter the Organization Name to use for this link.
      • Enter the Email where you want to receive the LOA-CFA details from the cloud provider.
        • GCP uses this email to send the Letter of Authorization and Connecting Facility Assignment (LOA-CFA). Be sure that the LOA-CFA is sent to your Colo provider, so they can begin to install your connections.

3. After the dedicated connection is created, the Colo facility tests your connections and informs you that they have been tested and are ready to use.

   No Prisma Access configuration is required for this step. Do not create the Colo-Connect connections in Prisma Access until the Colo facility lets you know that they have been tested.
4. Create the connections (also known as the VLAN attachments) for Colo-Connect.

   1. Make sure that the dedicated link status is Active by going to PanoramaCloud ServicesConfigurationColo-ConnectColo Connect Link.

      Until the Dedicated link status is Active, you cannot create Colo-Connect links.

   2. Go to PanoramaCloud ServicesConfigurationColo-ConnectOnboarding and Add a new connection.
   3. Configure the connection settings.

      • Enter a unique Name for the connection.
      • Select a Link Name from the links you configured in a previous step.
      • (Optional) Enter a VLAN ID for the connection.
        VLAN IDs are generated by the interconnect vendor (GCP) if you do not manually enter a value.
      • Select a Bandwidth for the connection.
        You can select between 1 Gbps, 2 Gbps, 5 Gbps, 10 Gbps, or 20 Gbps.
        If you configure multiple connections for an interconnect, make sure that the total bandwidth of the connections does not exceed the bandwidth of the interconnect. For example, given a dedicated interconnect of 20 Gbps, you can configure 10 connections of 2 Gbps each, but do not exceed 20 Gbps in total for all connections.
      • Enter a BGP Peer ASN.
        Enter the Autonomous System (AS) number for the customer on-premises router in the Colo. The range is between 1 and 4294967295.
      • Select the Location from the connection names you created in a previous step.
        You must have already added a subnet for any location you specify.
      • (Optional) Enter the BGP MD5 Secret.

   4. Continue to create connections until complete.

      You must create two connections. Both connections must be in the same region and one connection each must be in a separate zone. You use these connections in service connections you create in a later step.
5. Commit and push your changes.

   1. Go to CommitCommit and Push.
   2. Edit Selections and make sure that Colo-Connect is selected in the push scope.

   3. Click OK to save your changes to the Push Scope.
   4. Commit and Push your changes.
6. Configure eBGP routing on the customer router.

   You need to set up BGP peering to ensure connectivity between the customer router,
7. Set up the service connections to use with Colo-Connect.
8. Commit and Push your configuration changes, making sure that Colo-Connect is selected in the Push Scope.
9. Check the status of the Colo-Connect connections.

   1. To check the status of a service connection used by a Colo-Connect connection, go to PanoramaCloud ServicesStatusColo ConnectMonitor.

   2. Hover over a region that has a Colo-Connect connection deployed.

      • If the Colo-Connect connection and the BGP routing are both up, the Status displays OK.
      • If the Colo-Connect connection is up but BGP routing is not up, the Status displays Warning.
      • If the Colo-Connect connection and BGP routing are down, the Status displays Down.
      • If the Colo-Connect connection is down but BGP routing is up, the Status displays Error.

   3. For more information, click the region box and view the information in the Status tab.
10. Check the network details of the Colo-Connect connections by going to PanoramaCloud ServicesStatusNetwork DetailsColo Connect and viewing the details.

    For dedicated links, the Pairing Key displays as N/A.

Configure VLAN eBGP Routing On the Customer Router

GCP creates IP addresses for the customer (Colo) router and the cloud router during these stages of your deployment:

• For partner interconnects, GCP creates the IP addresses after the pairing key is consumed by your Colo (for example, Equinix).
• For dedicated interconnects, GCP creates the IP addresses after you onboard your Colo-Connect connections (VLAN attachments) and commit and push your changes.

To ensure correct routing, you must:

• Configure the Colo router IP address (the Colo CPE IP in the Prisma Access UI) as the local VLAN IP address and the local eBGP IP address
• Configure the cloud router IP address (Cloud Router IP) as the eBGP peer address on your Colo router.

When complete, eBGP is configured for the connection (VLAN attachment) between the Colo router and the cloud router.

Creating this routing is the first step in setting up GRE tunnel routing. You complete the GRE tunnel routing when you set up GRE tunnels during service connection configuration.

Use the following steps to configure routing between the Colo and the cloud router.

1. From the Panorama that manages Prisma Access, create the subnets, links, and connections and Commit and Push your changes.

   Use the workflow specific to your interconnect type (either Partner or Dedicated) For Partner interconnects, be sure that you pasted the Pairing Key into the Colo VLAN.
2. Go to PanoramaCloud ServicesStatusNetwork DetailsColo Connect.
3. Make a note of the following connection elements:

   • Colo CPE IP
   • Cloud Router IP
   • Cloud Router BGP ASN

   In the following example:

   • For the vlan-central-1 connection, the Colo CPE IP is 169.254.24.170/29, the Cloud Router IP is 169.254.24.169/29, and the Cloud Router BGP ASN is 16550
   • For the vlan-central-2 connection, the Colo CPE IP is 169.254.120.74/29, the Cloud Router IP is 169.254.120.73/29, and the Cloud Router BGP ASN is 16550.
   • .

4. Determine the IP addresses you will use for the local GRE IP addresses when you set up the Colo-Connect service connections.

   You configure these when you set up a Colo-Connect service connection (PanoramaCloud ServicesConfigurationService Connection). in the Peer IP 1 and Peer IP 2 areas.

   If you are configuring a service connection to support up to 10 Gbps of throughput, put one tunnel each in Connection 1 and Connection 2, for a total of two tunnels in each service connection.

   If you are configuring a service connection to support more than 10 Gbps of throughput (up to 20 Gbps), put two tunnels each in Connection 1 and Connection 2, for a total of four tunnels in each service connection.

   The following examples show a tunnel being configured for more than 10 Gbps throughput, so two tunnels per connection are used, and they use the following peer IP addresses:

   • 172.120.1.1 for Connection 1
   • 172.130.1.1 for Connection 1
   • 172.121.1.1 for Connection 2
   • 172.131.1.1 for Connection 2
5. Log in to the Colo router.

   The following configuration screenshots use a Palo Alto Networks next-generation firewall as the Colo router.
6. Add a VLAN interface, specifying the Colo CPE IP address as the IP address.

   If you are using a next-generation firewall as the Colo router, go to NetworkInterfacesVLAN and Add the VLAN interface, specifying the Virtual Router name, and

7. Configure the Colo router IP address (Colo CPE IP) as the local eBGP IP address and Configure the cloud router IP address (Cloud Router IP) as the eBGP peer address on your Colo router.

   If you are using a next-generation firewall as the Colo router, go to NetworkVirtual Routers, Add a virtual router, go to BGPPeer Group, and enter the Colo CPE IP as the Peer Address and the Cloud Router IP as the Local Address.

8. Configure the Cloud Router BGP ASN as the eBGP peer Autonomous System Number (ASN).

   If you are using a next-generation firewall as the Colo router, go to NetworkVirtual Routers, Add a virtual router, go to BGPPeer Group, Add a peer group, and select a Peer AS of 16500.

9. Create a BGP export policy that allows only the local GRE IP address to be advertised to the cloud router peer IP address.

   Because cloud routers can receive only a limited number of routes, you need to create policies so that only the routing between the IP addresses for the service connection GRE tunnels are sent to the cloud router.

   If you are using a next-generation firewall as the Colo router, go to NetworkVirtual Routers, Add a virtual router, go to BGPExport, Add an export rule, Match the IP addresses used as the peer IP address, and create an Action of Allow.

10. Create the Colo-Connect service connections.

Create Colo-Connect Service Connections

1. From the Panorama that manages Prisma Access, make sure that Prisma Access withdraws static routes by going to PanoramaCloud ServicesConfigurationService Setup, clicking the gear icon to edit the Settings, and selecting Withdraw Static Routes if Service Connection or Remote Network IPSec tunnel is down.

   Selecting this choice ensures that, if GRE tunnel is down, the static route used by the GRE tunnel is withdrawn.

2. Go to the Colo-Connect tab and make sure that the connections are in an Active state by checking the Status field in the Onboarding area.

   Until the Status of the connection is Active, you cannot configure service connections.

3. Go to PanoramaCloud ServicesConfigurationService Connection.
4. Click Refresh on the top right of the Panorama UI so that the Colo-Connect configuration is provisioned in the service connections area.

5. Add a service connection, give it a unique Name, and select a Transport Type of Colo-Connect.

   Make sure that the name you enter is 31 characters long or less; entering a name 32 characters or longer causes the tunnel to be mapped incorrectly in the Prisma Access infrastructure.

6. Select two connections to use with the service connections (Connection 1 and Connection 2).

   These connections must be in two different zones.

7. Select Active or Backup for Connection 1 and Connection 2

   Use these guidelines when setting up service connections:

   • You can configure connections in these modes:
     • Active/Active
     • Active/Backup
     • Backup/Active
     Configuring both connections in Backup/Backup mode is invalid and not supported.
   • The bandwidth of the connections must be the same for all modes.
   • The connections must be in different zones.
   • The maximum bandwidth you can specify for a service connection is 20 Gbps. If you specify a Bandwidth of 20 Gbps for a connection, you cannot use that connection in a Active/Active configuration (it must be set as Active/Backup).
   • Do not mix dedicated and partner interconnects in the same service connection, and make sure that the service connections use different zones. This table shows the allowed and disallowed configurations for service connections, assuming that zones, locations, bandwidth, and roles follow the service connection guidelines and requirements:

     Connection 1 Belongs To	Connection 2 Belongs To	Valid Colo-Connect Service Connection Configuration?
     Partner Connect 1	Partner Connect 2	Yes
     Dedicated Connect 1	Dedicated Connect 2	Yes
     Partner Connect 1	Partner Connect 1	No
     Dedicated Connect 1	Dedicated Connect 1	No
     Partner Connect	Dedicated Connect	No

8. (Optional, Hot Potato Routing Deployments Only) Select a service connection to use as the preferred backup (Backup SC).

   You can only select a service connection that has been configured as Colo-Connect service connection. Prisma Access uses the Backup SC you select as the preferred service connection in the event of a connection failure. Selecting a backup service connection can prevent asymmetric routing issues if you have created more than two service connections.
9. (Optional) Enable Source NAT for Mobile Users—GlobalProtect IP pool addresses, IP addresses in the Infrastructure Subnet, or both.

   You can specify a subnet at one or more service connections that are used to NAT traffic between Prisma Access GlobalProtect mobile users and private applications and resources at a data center.

   • Enable Data Traffic Source NAT—Performs NAT on Mobile User IP address pool addresses so that they are not advertised to the data center, and only the subnets you specify at the service connections are advertised and routed in the data center.
   • Enable Infrastructure Traffic Source NAT—Performs NAT on addresses from the Infrastructure Subnet so that they are not advertised to the data center, and only those subnets you specify at the service connections are advertised and routed in the data center.
   • IP Pool—Specify the IP address pool used to perform NAT on the mobile user IP address pool, Infrastructure Subnet, or both. Use a private IP (RFC 1918) subnet or a suitable subnet that is routable in your routing domain, and does not overlap with the Mobile Users—GlobalProtect IP address pool or the Infrastructure Subnet. Enter a subnet between /25 and /32.

10. In the GRE and BGP area, configure the GRE tunnel and BGP settings for the service connection.

    BGP is always set to Enable.

    1. (Optional) Select from the following choices:

       • To add a no-export community for Corporate Access Nodes (Service Connections) to the outbound prefixes from the eBGP peers at the customer premises equipment (CPE), set Add no-export community to Enabled Out. This capability is Disabled by default.
         Do not use this capability in hot potato routing mode.
       • To prevent the Prisma Access BGP peer from forwarding routes into your organization’s network. Don’t Advertise Prisma Access Routes.
         By default, Prisma Access advertises all BGP routing information, including local routes and all prefixes it receives from other service connections, remote networks, and mobile user subnets. Select this check box to prevent Prisma Access from sending any BGP advertisements, but still use the BGP information it receives to learn routes from other BGP neighbors.
         Since Prisma Access does not send BGP advertisements if you select this option, you must configure static routes on the on-premises equipment to establish routes back to Prisma Access.
       • To reduce the number of mobile user IP subnet advertisements over BGP to your customer premises equipment (CPE), select Summarize Mobile User Routes before advertising.
         By default, Prisma Access advertises the mobile users IP address pools in blocks of /24 subnets; if you summarize them, Prisma Access advertises the pool based on the subnet you specified. For example, Prisma Access advertises a public user mobile IP pool of 10.8.0.0/20 using the /20 subnet, rather than dividing the pool into subnets of 10.8.1.0/24, 10.8.2.0/24, 10.8.3.0/24, and so on before advertising them. Summarizing these advertisements can reduce the number of routes stored in CPE routing tables. For example, you can use IP pool summarization with cloud VPN gateways (Virtual Private Gateways (VGWs) or Transit Gateways (TGWs)) that can accept a limited number of routes.
         If you have hot potato routing enabled and you enable route summarization, Prisma Access no longer prepends AS-PATHs, which might cause asymmetric routing. Be sure that your return traffic from the data center or headquarters location has guaranteed symmetric return before you enable route summarization with hot potato routing.
    2. Set up routing for the service connection using GRE tunnels.
    3. From the Panorama that manages Prisma Access, return to PanoramaCloud ServiceConfigurationService Connection a GRE tunnel for Connection 1 by entering a GRE Tunnel Name 1 and a Peer IP 1 for Connection 1 and, if more than 10 Gbps of bandwidth is required, entering GRE Tunnel Name 2 and Peer IP 2 for the second tunnel for Connection 1; then, create a GRE tunnel for Connection 2 by repeating these same steps.

       Each pair of GRE tunnels in a connection supports a maximum of 10 Gbps of bandwidth. If you require more than 10 Gbps of bandwidth, configure two tunnels per connection. For example:

       For the Peer IP, enter the GRE IP address of the on-premises router in the Colo.

       Use IPv4 addresses for the BGP values; IPv6 is not supported.
    4. Enter the Peer Address and the Local Address for the BGP Peer 1 and, if a second tunnel was required for Connection 1, BGP Peer 2.

       For Peer Address, enter the BGP Peer IP address of the Colo router; for Local Address, enter the address that will be used for BGP network establishment over the GRE tunnel.
    5. (Optional) To configure a BGP secret, enter the Secret and Confirm Secret values.

11. Commit and Push your configuration changes, making sure that Colo-Connect is selected in the Push Scope.

Set Up Routing for the Service Connection Using GRE Tunnels

The Colo router advertises its GRE tunnel peer IP address to the cloud router, and learns the subnet for the GRE tunnel from the cloud router. When you first configured the eBGP routing over the VLAN on the customer router, you advertised local reachability for the GRE tunnels. After the cloud router and the Colo router advertise and learn the routes for the Colo subnet and the local GRE IP addresses from each other, the GRE tunnels used by the service connection become active (up).

To set up routing and add GRE tunnels to the service connections, complete the following steps.

1. Make a note of the IP addresses you will use for the Peer Address and the Local Address for the BGP Peer 1 and, if a second tunnel was required for Connection 1, BGP Peer 2.

   The following examples use the following peer and local addresses:

   • Peer Address—10.10.120.0 and 10.10.130.1 for Connection 1, 10.10.120.2 and 10.10.130.2 for Connection 2
   • Local Address—10.10.120.2 and 10.10.130.2 for Connection 1, 10.10.121.2 and 10.10.131.2 for Connection 2
2. Make a note of the IP addresses you will use for the Peer IP 1 and, if required, Peer IP 2 address in the service connections.

   You use these IP addresses to create a Deny policy that prevents the local GRE IP address to be advertised to the Colo-Connect service connection.

   All examples in this document use these IP addresses:

   • 172.120.1.1 for Connection 1
   • 172.130.1.1 for Connection 1
   • 172.121.1.1 for Connection 2
   • 172.131.1.1 for Connection 2
3. Configure Peer groups for the peer and local IP addresses.

   If you are using a next-generation firewall as the Colo router, go to NetworkVirtual Routers, Add a virtual router, go to BGPPeer Group, and enter the Peer Address as the Peer Address and the Local Address as the Local Address.

4. Create a BGP export policy to deny the peer IP addresses you configured (172.120.1.1, 172.130.1.1, 172.121.1.1, and 172.131.1.1) and apply them to the peer groups you created.

   This export policy places a DENY rule on the local GRE tunnel peer IP addresses and allows all other routes to be advertised to the service connection.

   If you are using a next-generation firewall as the Colo router, go to NetworkVirtual Routers, Add a virtual router, go to BGPExport, Add an export rule, Match the IP addresses used as the peer IP address, and create an Action of Deny.

Increase or Decrease the Bandwidth of a Colo-Connect Service Connections

Delete a Colo-Connect Connection

1. Delete the service connections associated with the connection by going to PanoramaCloud ServicesConfigurationService Connection, selecting the service connection, and Delete it.

2. Commit and Push your changes, selecting Service Connections in the Push Scope.
3. Delete the Colo-Connect connections associated with the connection by going to PanoramaCloud ServicesConfigurationColo-Connect, selecting the Connection Name in the Onboarding section, and Delete it.

4. Delete the Colo-Connect link by selecting the Link Name and Delete it.

5. Delete the GRE local (peer) IP addresses to your export policies for the VLAN eBGP routing and service connection routing for the GRE tunnels.