>
    Strata Copilot
    Configure NGFW Connector Group and Application Targets
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access
    3. Prisma Access Administration
    4. NGFW ZTNA Connector Integration
    5. Configure NGFW Connector Group and Application Targets
    Download PDF
    Prisma Access

    Configure NGFW Connector Group and Application Targets

    Table of Contents

    Configure NGFW Connector Group and Application Targets

    Create a Connector Group, add NGFW Connectors, and define application targets to enable private application access through Prisma Access.
    Where Can I Use This?What Do I Need?
    • Prisma Access (Managed by Panorama)
    • NGFW (Hardware and VM-Series)
    • No prerequisites needed
    After completing the management-interface-specific setup in either Panorama or Strata Cloud Manager, create a ZTNA Connector Group in Strata Cloud Manager and add your NGFWs as connectors. These steps apply regardless of whether your NGFWs are managed by Panorama or Strata Cloud Manager. Configure the application target types — Wildcard, FQDN, or IP Subnet — that match how your private applications are identified in your data center.
    Review these operational constraints before proceeding:
    • Advanced routing mode is not supported for NGFW Connector. Only default routing mode is supported.
    • High Availability (HA) mode is not supported. You can onboard multiple NGFWs separately with different serial numbers and attach them to the same Connector Group.
    • If your NGFW Connector is disconnected from the management interface, configuration push fails. Push the configuration again after reconnection.
    1. In Strata Cloud Manager, select ConfigurationZTNA ConnectorConnector Groups and select Create Connector Group.
      1. Enter a Name and choose NGFW Connector as the Group Type.
      2. Select Create.
    2. Select NGFW Connectors and select Create NGFW Connector.
      1. Enter a Name and choose your Connector Group.
      2. Under NGFW Connector, choose your NGFW's serial number from the list of available connectors.
      3. Select Create.
    3. (Optional) Enable Server-Initiated Traffic to allow private application servers to initiate connections to Prisma® Access users or remote networks.
      1. Configure Destinations for server-initiated traffic.
        • To allow servers to initiate connections to GlobalProtect users, enable the Mobile User Pools checkbox to allow access to all mobile user pools.
        • To allow connections to hosts on remote networks, enable the Remote Network Pools checkbox and enter the specific IP subnets to allow access.
        • To allow connections to destinations in another NGFW Connector group's IP subnet targets, enable the ZTNA Connector Data Center checkbox and select the IP subnets to allow access.
          FQDN targets are not supported for NGFW Connector server-initiated traffic.
      2. Select Routing and select the settings icon. Under Connectors with Server Initiated Traffic Enabled, select the connector to configure data center routing.
        Only Static is supported as the Routing Type for server-initiated traffic.
    4. Monitor the ZTNA Connector status to confirm tunnels are established and your NGFW is connected.
    5. (Optional) Add Wildcard Targets to automatically onboard private applications that match a wildcard domain pattern.
      1. Select Wildcard Targets and select Create Wildcard Target.
      2. Enter a unique Name for the target.
      3. Choose the Connector Group of type FQDN/Wildcard to associate with this target.
      4. Enter the Wildcard domain (for example, .example.com or .my.example.com).
        The interface adds the asterisk prefix automatically. Do not specify wildcards of the form *.*, example.*.com, or *.com.
      5. Choose the Protocol (tcp, udp, or both).
      6. Specify the Port for the application.
        Enter a single port, multiple ports separated by commas, or a range using dashes. If you select both TCP and UDP, enter ports separately in TCP Port and UDP Port. Do not add spaces after commas.
      7. Choose a Probing Type of icmp ping or none.
        Selecting tcp ping acts the same as none for FQDN and wildcard targets. Select icmp ping to probe the FQDN's resolved IP address — if a response is received, the app is marked Up. Select none to disable probing and always mark the app as Up.
      8. Select Activated and select Create.
    6. (Optional) Add FQDN Targets to provide access to specific private applications identified by a single fully qualified domain name.
      Select FQDN Targets and Create FQDN Target. Follow the same steps as for wildcard targets, entering a single FQDN instead of a wildcard pattern. Applications automatically discovered through a parent wildcard target also appear here — when users access an app that matches the wildcard (for example, app1.example.com for the wildcard *.example.com), ZTNA Connector automatically onboards that app as an FQDN target.
    7. (Optional) Add IP Subnet Targets to provide routing-based access to private applications identified by IP address.
      1. Select IP Subnets and select Create Subnet Rule.
      2. Enter a unique Name for the target.
      3. Choose the Connector Group of type IP Subnet to associate with this target.
      4. Specify the data center IP Subnets to which the connector group provides routing access.
        Enter a single IP address (for example, 10.1.1.1/32), a single subnet, or multiple subnets separated by commas. Enter a maximum of 16 subnets. Subnets must not overlap with any other IP subnets in the tenant, including:
      5. Select Create.

    © 2026 Palo Alto Networks, Inc. All rights reserved.