Prisma Access
Panorama
Table of Contents
Expand All
|
Collapse All
Prisma Access Docs
-
- Prisma Access China
- 4.0 & Later
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
-
-
-
- 5.1 Preferred and Innovation
- 5.0 Preferred and Innovation
- 4.2 Preferred
- 4.1 Preferred
- 4.0 Preferred
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
Security Policy for Apps Enabled with ZTNA Connector (Panorama)
Panorama
)Set up a Security policy rule that enables users to access apps behind ZTNA Connector
for Panorama Managed Prisma Access deployments.
After you onboard apps to ZTNA Connector, you should set up policy rules to allow and
control access for those apps. The procedure to create and apply policy differs on
whether your apps are defined by wildcards, IP Subnets, or FQDNs.
Security Policy for Wildcard-Based Apps
Wilcard-based apps ( () require that you create a custom URL category; however, that
type of category only enforces policy for HTTP and HTTPS traffic, and other
traffic (such as SSH) isn't allowed. For this reason, you need to temporarily
allow access to all apps by allowing traffic to the ZTNA Connector Application
IP blocks.
Settings
ZTNA Connector
Application Targets
Wildcard Targets
After ZTNA Connector learns the FQDNs that are based on the wildcards, you can
disable the policy that allows Application IP Block traffic and apply policy
enforcement based on the learned FQDNs.
- Create a policy to allow the IP addresses for the ZTNA Connector Application IP Blocks.
- From the ZTNA Connector UI, go toand make a note of theManageService SetupSharedPrisma Access SetupInfrastructure SettingsApplication IP Blocksunder ZTNA Connector IPs.If you're using Strata Cloud Manager, go toand make a note of theWorkflowsPrisma Access SetupPrisma AccessPrisma Access SetupApplication IP Blocksunder ZTNA Connector IPs.
- Go toandObjectsAddressesAddaddress objects based on the IP addresses you retrieved.
- Go ToandObjectsAddress GroupsAddthe address objects you created to an address group.
- Go toandPoliciesSecurityPre RulesAdda Security policy to allow access to all application IP address blocks, specifying theAddress Groupyou created in an earlier step.Adding this Security policy allows all traffic from wildcard-based app traffic to be passed while ZTNA Connector discovers the apps based on wildcards. Without the rule to allow the Application IP Blocks, users can't access wildcard-based apps.You can leave this policy in place until ZTNA Connector discovers the wildcard-based apps. Then, you can choose to disable this policy and add Security policy rules for each of the discovered apps.
- After ZTNA Connector has discovered the apps based on wildcards, configure a Security policy for the apps that you added using FQDNs.
- Go toand make a note of the FQDNs used by the apps.SettingsZTNA ConnectorConnectorsApplication TargetsFQDN TargetsIf you're using Strata Cloud Manager, go toand make a note of the FQDNs used by the apps.WorkflowsZTNA ConnectorApplication TargetsFQDN Targets
- Create an Address object for the FQDN ().ObjectsAddressesSelect either theMobile_User_Device_Groupor theRemote_Network_Device_Group, depending on whether mobile users or users at branch sites will be accessing the private apps behind ZTNA Connector.
- Addan address object with theTypeofFQDNand enter theFQDNof the discovered application.Enter the FQDNs for the FQDN targets.
- Go toandPoliciesSecurityPre RulesAdda Security policy to allow access to the discovered apps.
- Commit and Pushyour changes.
- (Optional) After you have created the Security policy based on FQDNs, remove the policy based on the IP application blocks.
Security Policy for IP Subnet-Based Apps
If you created ZTNA Connector application targets
based on IP subnets (), complete the following steps to allow access to the apps.
Settings
ZTNA Connector
Connectors
Application Targets
IP Subnets
- Go toand make a note of the IP subnets used by the apps.SettingsZTNA ConnectorConnectorsApplication TargetsIP SubnetsIf you're using Strata Cloud Manager, go toand make a note of the IP subnets used by the apps.WorkflowsZTNA ConnectorApplication TargetsIP Subnets
- Create a policy to allow the IP addresses for the IP subnets used for the apps.
- Go ToandObjectsAddressesAddaddress objects based on the IP addresses you retrieved.If you're using Strata Cloud Manager, go toandManageConfigurationNGFW and Prisma AccessObjectsAddressAddressesAddaddress objects based on the IP addresses you retrieved.
- Go ToandObjectsAddress GroupsAddthe addresses you created to the address groups.
- Go toandPoliciesSecurityPre RulesAdda Security policy to allow access to the IP subnets for the apps, specifying theAddressesyou created in an earlier step.
- Push Configto save and push your configuration changes.
Security Policy for FQDN-Based Apps
If you have added targets based on FQDNs (), create an address object and a Security policy to allow access to
the apps by completing the following steps.
Settings
ZTNA Connector
Connectors
Application Targets
FQDN Targets
- Configure a Security policy for the apps that you added using FQDNs.
- Go toand make a note of the FQDNs used by the apps.SettingsZTNA ConnectorConnectorsApplication TargetsFQDN TargetsIf you're using Strata Cloud Manager, go toand make a note of the FQDNs used by the apps.WorkflowsZTNA ConnectorApplication TargetsFQDN Targets
- Create an Address object for the FQDN ().ObjectsAddressesSelect either theMobile_User_Device_Groupor theRemote_Network_Device_Group, depending on whether mobile users or users at branch sites will be accessing the private apps behind ZTNA Connector.
- Addan address object with theTypeofFQDNand enter theFQDNof the discovered application.Enter the FQDNs for all discovered apps.
- OptionalGo toandManageConfigurationNGFW and Prisma AccessSecurity ServicesSecurity PolicyPre RulesAdda Security policy to allow access to the discovered apps.If you're using Strata Cloud Manager, go toandManageConfigurationNGFW and Prisma AccessSecurity ServicesSecurity PolicyPre RulesAdda Security policy to allow access to the discovered apps.
- Push Configto save and push your configuration changes.