Guidelines for Using Secure Inbound Access

When you configure a remote network for inbound access, you add units (Mbps) from your license for the IP addresses you allocate (150 Mbps for 5 IP addresses and 300 Mbps for 10 IP addresses). For this reason, make sure that you have enough remaining licensed bandwidth to onboard the inbound access remote networks before you start. To check your available bandwidth, select
Panorama
Cloud Services
Configuration
Remote Networks
and view your licensed
Bandwidth Allocation
. This area shows the bandwidth you have already allocated, along with the total licensed bandwidth.

The following locations are supported:
Australia Southeast
Belgium
Brazil South
Canada East
Finland
Germany Central
Hong Kong
India West
Japan Central
Japan South
Netherlands Central
Singapore
Switzerland
Taiwan
UK
US Central
US East
US Northwest
US Southeast
US Southwest
You cannot modify an existing remote network to provide secure inbound access; instead, create a new remote network.
The inbound access feature is not available on remote networks that use ECMP load balancing.
Application port translation is not supported.
The bulk import feature to onboard remote networks does not support inbound access. Use Panorama to onboard new inbound access remote networks.
Do not use remote network inbound access with traffic forwarding rules with service connections.
Outbound traffic originating at the branch is not allowed on the inbound remote network.
User-ID and application authentication are not supported.
Prisma Access
enforces the following rate limiting thresholds to provide flood protection, and measures the rate in connections per second (CPS):
Flood Protection Type	Alarm Rate in CPS	Activate Rate in CPS
SYN Flood	10000	15000
ICMP Flood	20	20
If you require greater protection against flooding of new sessions, contact your Palo Alto Networks team.
Remote networks that are configured for secure inbound access can only be used for that purpose. If you require outbound access as well as inbound access for a remote network site, create two remote network sites in the same location—one for inbound access and one for outbound access—as shown in the following figure. In this example, User 1 uses Remote Network 1 for inbound access to www.example.com, while User 2 uses Remote Network 2 for outbound internet access from the remote network location.

If you have a custom
Prisma Access
deployment where one of the cloud providers is excluded, inbound access might not be supported; in this case, you cannot choose the location during remote network onboarding.
Secure inbound access is not supported with evaluation licenses.