Cloud Management

Select
Manage
Service Connections
Service Connections Setup
.
If you're using Strata Cloud Manager, go to
Workflows
Prisma Access
Setup
Service Connections
and
Add Service Connection
.
Give the service connection a descriptive
Name
.
Select the
Prisma Access
Location
where your HQ or data center is located.
(
Optional
) Enable source NAT for Mobile Users—GlobalProtect IP pool addresses, IP addresses in the Infrastructure subnet, or both.
You can specify a subnet at one or more service connections that are used to NAT traffic between
Prisma Access
GlobalProtect mobile users and private applications and resources at a data center.
Data Traffic source NAT
—Performs NAT on Mobile User IP address pool addresses so that they are not advertised to the data center, and only the subnets you specify at the service connections are advertised and routed in the data center.
Infrastructure Traffic source NAT
—Performs NAT on addresses from the Infrastructure subnet so that they are not advertised to the data center, and only those subnets you specify at the service connections are advertised and routed in the data center.
User-ID
—When selected,
Prisma Access
uses this service connection for identity redistribution.
User-ID Redistribution Management
—Sometimes, granular controls are needed for user-ID redistribution in particularly large scale Prisma Access deployments. User-ID Redistribution Management lets you manually disable the default identity redistribution behavior for certain service connections by removing the check mark in the
User ID
column, and then select specific service connections to be used for identity redistribution. It's not necessary to do this for most configurations. Contact Palo Alto Networks support to activate this functionality.
Source NAT Pool
—Specify the IP address pool used to perform NAT on the mobile user IP address pool, Infrastructure subnet, or both.
Use a private IP (RFC 1918) subnet or a suitable subnet that is routable in your routing domain.
Make sure that the subnet does not overlap with the Mobile Users—GlobalProtect IP address pool, the Infrastructure subnet, or any other source NAT addresses used for this tenant.
Enter a subnet between /25 and /32.

Select an
IPSec Tunnel
. If you have not yet set up a primary or secondary IPSec Tunnel, select
Set Up
and follow the steps below.
Give the tunnel a descriptive
Name
.
Select the
Branch Device Type
for the IPSec device and the HQ or data center that you’re using to establish the tunnel with
Prisma Access
.
For the
Branch Device IP Address
, choose to use either a
Static IP
address that identifies the tunnel endpoint or a
Dynamic
IP address.
If you set the
Branch Device IP Address
to
Dynamic
, you must also add the IKE ID for the HQ or data center (
IKE Local Identification
) or for
Prisma Access
(
IKE Peer Identification
) to enable the IPSec peers to authenticate.
Because you don't have the values to use for the
Prisma Access
IKE ID (
IKE Peer Identification
) until the service connection is fully deployed, you would typically want to set the IKE ID for the HQ or data center (
IKE Local Identification
) rather than the
Prisma Access
IKE ID.
Turn on
Tunnel Monitoring
.
Enter a Tunnel Monitoring
Destination IP
address on the HQ or data center network for
Prisma Access
to determine whether the tunnel is up and, if your branch IPSec device uses a policy-based, enter the associated
Proxy ID
.
The tunnel monitoring IP address you enter is automatically added to the list of branch subnetworks.
Save
the tunnel settings.
To add or adjust routing and Quality of Service settings, go to
Manage
Service Connections
Service Connections Setup
Routing and QoS
.
If you're using Strata Cloud Manager, go to
Workflows
Prisma Access
Setup
Service Connections
and
Add Service Connection
.
Set Up
or
Edit
the
Routing
or
QoS
settings.
Configure static routes.
For static routes to route traffic to and from your HQ or data center,
Add
the IP subnets or IP addresses that you want to secure at the branch.
If you make any changes to the IP subnets on your HQ or data center network, you must manually update the static routes.
Configure dynamic routing.
For dynamic routing to advertise HQ or data center subnets,
Enable BGP for Dynamic Routing
.
(
Optional
) Select an
MRAI Timer
value.
BGP routing offers a timer you can use to tailor BGP routing convergence in your network called the
Minimum Route Advertisement Interval (MRAI)
. MRAI acts to rate-limit updates on a per-destination basis, and the BGP routers wait for at least the configured MRAI time before sending an advertisement for the same prefix. A smaller number gives you faster convergence time but creates more advertisements in your network. A larger number decreases the number of advertisements that can be sent, but can also make routing convergence slower. You decide the number to put in your network for the best balance between faster routing convergence and fewer advertisements.
Configure an MRAI range of between 1 and 600 seconds, with a default value of 30 seconds.
To reduce the number of mobile user IP subnet advertisements over BGP to your customer premises equipment (CPE), specify
Prisma Access
to summarize the subnets before it advertises them by selecting
Summarize Mobile User Routes before advertising
.
By default,
Prisma Access
advertises the mobile users IP address pools in blocks of /24 subnets; if you summarize them,
Prisma Access
advertises the pool based on the subnet you specified. For example, Prisma Access advertises a public user mobile IP pool of 10.8.0.0/20 using the /20 subnet, rather than dividing the pool into subnets of 10.8.1.0/24, 10.8.2.0/24, 10.8.3.0/24, and so on, before advertising them. Summarizing these advertisements can reduce the number of routes stored in CPE routing tables. For example, you can use IP pool summarization with cloud VPN gateways (Virtual Private Gateways (VGWs) or Transit Gateways (TGWs)) that can accept a limited number of routes.
(
Optional
) to have
Prisma Access
originate a default route advertisement for the remote network using eBGP, select
Advertise the Default Route
. Be sure that your network does not have another default route being advertised by BGP, or you could introduce routing issues in your network.
(
Optional
) If you configured a secondary WAN and you need to change the peer address for the secondary (backup) BGP peer, select
Use different BGP Peer for Secondary Tunnel
and enter a unique Peer and, optionally, Local IP address for the secondary WAN.
To add a community for service connections) to the outbound prefixes from the eBGP peers at the customer premises equipment (CPE), set
Add no-export community
to
Enabled Out
. This capability is
Disabled
by default.
(
Optional
) Select
Do Not Export Routes
to prevent
Prisma Access
from forwarding routes into the HQ or data center.
By default,
Prisma Access
advertises all BGP routing information, including local routes and all prefixes it receives from other service connections, remote networks, and mobile user subnets. Select this check box to prevent
Prisma Access
from sending any BGP advertisements, but still use the BGP information it receives to learn routes from other BGP neighbors.
Because
Prisma Access
does not send BGP advertisements, if you select this option you must configure static routes on your on-premises equipment to establish routes back to Prisma Access.
Enter the
Peer IP Address
assigned as the Router ID of the eBGP router on the HQ or data center network.
Enter the
Peer AS
, the autonomous system (AS) for your network.
Use and RFC 6996-compliant BGP Private AS number.
Enter the
Local IP Address
that
Prisma Access
uses as its Local IP address for BGP.
A local address is only required if your HQ or data center device requires it for BGP peering to be successful. Make sure the address you specify does not conflict or overlap with IP addresses in the infrastructure subnet or subnets in the remote network.
Enter a
Secret
password to authenticate BGP peer communications.
Select
Confirm Secret
.

(
Optional
) Configure QoS.
To start, add a QoS Profile to define the QoS classes that will shape traffic between the HQ or data center and
Prisma Access
. You’ll then create a QoS policy rule and add the profile to the rule, to enforce QoS on matching HQ or data center traffic.

Enter a name for your
QoS Profile
.
Select
Create New
.
Set the maximum throughput (in Mbps) for traffic leaving the HQ or data center service connection as the
Egress Max
.
You can specify a value up to the maximum licensed bandwidth of your HQ or data center.
Set the guaranteed bandwidth as the
Egress Guaranteed
(in Mbps).
Any traffic that exceeds the Egress Guaranteed value is best effort but not guaranteed. Any bandwidth that is guaranteed but unused remains available to all traffic.
Define each QoS
Class
and attach it to a policy rule.
A QoS class determines the priority and bandwidth for traffic matching a QoS policy rule. There are up to eight definable QoS classes in a single QoS Profile. Unless otherwise configured, traffic that does not match a QoS class is assigned a class of 4.
Configure the
Priority
of a QoS Class.
Priorities include real-time, high, medium, or low.
Configure the
Egress Max
value.
The egress max value for a QoS class, or the combined egress max values for multiple QoS classes, must not exceed the egress max value for the QoS Profile.
Configure the
Egress Guaranteed
value.
The guaranteed bandwidth assigned to the QoS class isn't reserved for that class; unused bandwidth remains available to all traffic. Any class traffic that exceeds the egress-guaranteed value is best effort but not guaranteed.

Verify Service Connection Status

To verify that the service connection has been successfully set up, select

Manage > Service Setup > Service Connections > Sites

and check that the

Status

is

OK

.

If you're using Strata Cloud Manager, go to

Workflows

Prisma Access

Setup

Service Connections

.

If the status isn't

OK

, hover over the Status icon to view any errors.

The

Sites

area allows you to view all onboarded service connections, along with their status and other details about them.

Site

Name
—The name of the service connection.
Active/Backup
—The active and backup locations of the service connection.
Subnets
—The assigned infrastructure subnets of the service connection.

Status

Tunnel
—The operational status of the connection between
Prisma Access
and your service connection.
Config
—The status of your last configuration push to service. If the local configuration and the configuration in the cloud match, the Config Status is
In sync
. If you have made a change locally, and not yet pushed the configuration to the cloud, this may display the status
Out of sync
. Hover over the status indicator for more detailed information. After committing and pushing the configuration to
Prisma Access
, the Config Status changes to
In sync
.

Prisma Access

Location
—The location where the service connection is deployed.
Service IP
—The IP address of the service connection.
EBGP Router
—The IP address of the EBGP Router in the service connection.

Links

BGP IPv4
—The status of the BGP IPv4 routing in the service connection.
BGP IPv6
—The status of the BGP IPv6 routing in the service connection.
IPSec Tunnel
—The IPSec tunnel of your service connection. The first IPSec tunnel you establish will be the
(Primary)
tunnel. If you established a second IPSec tunnel it will be the
(Secondary)
tunnel.
Peer IP Address
—The gateway IP address of the service connection.