NGFW ZTNA Connector Integration leverages your Palo Alto Networks® NGFWs (VM-Series and Hardware NGFW) as ZTNA Connectors. This provides secure, automated connectivity to private applications for Prisma Access users, supporting mobile, contractor, and branch users. You can manage NGFW Connectors using either Panorama or Strata Cloud Manager.

Core Components

• Palo Alto Networks NGFW — Your NGFW serves as the primary device securing private applications. Configured as a ZTNA Connector, it establishes secure tunnels to Prisma Access and enforces access policies. Supported platforms include VM-Series and Hardware NGFW.
• Management Interface — Your management interface (Panorama or Strata Cloud Manager) orchestrates the configuration and deployment of ZTNA Connector functionality to your managed NGFWs. For Panorama-managed NGFWs, the Cloud Services Plugin (CSP) is required for communication and configuration synchronization with Prisma Access. For Strata Cloud Manager-managed NGFWs, both Prisma Access and your NGFWs must belong to the same tenant for automatic registration.
• Prisma Access Cloud Management — This cloud-based control plane manages Prisma Access services, including ZTNA Connectors. It provides the interface for onboarding NGFWs, creating Connector Groups, and defining application access policies.
• Applications — Private applications accessed through the connector, defined by wildcard FQDN, FQDN, or IP subnet.

Architectural Flow

Application Onboarding (Non-Wildcard) — This process defines and configures access for specific private applications using FQDNs or IP addresses and ports, enabling users to securely reach explicitly defined applications behind the NGFW Connector.

• You specify the application's FQDN or IP address, port range, and probe type in Prisma Access.
• Prisma Access generates NAT rules, DNS proxy rules, and application probe configurations.
• For each NGFW Connector in the group, ZTNA Connector creates application-specific configuration, including static routes, application probes, and FQDN-based NAT rules.
• This configuration is published to the management interface, which then pulls and commits it to your NGFW.
• Your NGFW advertises the application's reachability to Prisma Access via BGP, based on continuous path monitoring results.

Wildcard Application Discovery and Onboarding — This mechanism dynamically discovers and onboards applications within a specified wildcard domain, simplifying management for environments with numerous or frequently changing applications.

• You configure Prisma Access to onboard wildcard-based applications.
• Your NGFW enables a DNS Proxy on a dedicated loopback interface, created by the ZTNA Connector during connector onboarding.
• DNS requests from Prisma Access users for wildcard applications are forwarded to this DNS Proxy on your NGFW.
• Your NGFW resolves the DNS request and sends the reply back to the ZTT.
• The ZTT intercepts the reply and notifies ZTNA Connector about the newly discovered application.
• ZTNA Connector then onboards this application, generating and pushing necessary NAT, routing, and probe configurations to your NGFW via the management interface.

Handling Overlapped IP Networks — This feature provides secure access to private applications even when their IP addresses overlap with other networks in Prisma Access or other customer networks, preventing IP address conflicts and ensuring correct routing. For overlapped networks, only FQDNs and Wildcard FQDNs are supported for onboarding.

• You indicate if an application is in an overlapped IP network during onboarding via a checkbox in Strata Cloud Manager.
• Your NGFW uses NAT, including SNAT and Destination NAT (DNAT), to translate overlapping IP addresses, ensuring unique addressing within Prisma Access.
• For overlapped IP addresses, your NGFW preserves the pre-NAT IP address in firewall logs.
• SNAT is applied on the egress interface to attract return traffic back to your NGFW.