Configure IKE, IPSec, and BGP and Onboard the Azure VNet in Prisma Access

In Strata Cloud Manager, select
Workflows
Prisma Access Setup
Remote Networks
.
(
Optional
) If you have not already, allocate bandwidth for the remote network under
Bandwidth Management
.
You allocate bandwidth by selecting bandwidth for the remote network’s compute location. Select an
Assigned Bandwidth
for the remote network’s compute location.
Go to
Remote Networks
and
Add Remote Networks
.

Give the remote network a descriptive
Site Name
.
Select the
Prisma Access Location
that is closest to your Azure VNet.
Select the
IPSec Termination Node
to use for the remote network.
Enable
ECMP Load Balancing
.
Set up the IPSec tunnel for the Azure gateway.
Set Up
the primary tunnel.

Select an existing tunnel, or select
Create New
to create a new tunnel.

Give the tunnel a descriptive
Name
.
Select the
Branch Device Type
for the IPSec device at the remote network site that you’re using to establish the tunnel with Prisma Access.
Specify a
Pre-Shared Key
.
Specify a
Branch Device IP Address
of either
Static IP
or
Dynamic IP
.
Setting up an
IKE Peer Identification
is required if you use a dynamic IP address. If you select
Static IP
, enter a static IP address.
Select
IKE Advanced Options
, create an IPSec crypto profile for the IPSec tunnel, and
Save
the changes.
The IPSec crypto settings you specify here must match the settings you specify on Azure. To set IKE and IPSec policies in Azure, see the Microsoft Azure documentation.
Select
IPSec Advanced Options
, create an IKEv1 crypto profile for the gateway, and
Save
the changes.
Set Up
BGP routing.
Enable BGP for Dynamic Routing
.
Enter the
Peer Address
value from Azure in the
Peer IP address
field and enter the
Autonomous system number (ASN)
value from Azure in the
Peer AS
field.
(
Optional
) Enter an address that Prisma Access uses as its
Local IP Address
for BGP.
Make sure that the address you specify does not conflict or overlap with IP addresses in the Infrastructure Subnet or subnets in the remote network.
You must configure a static route on your CPE to the BGP local address.
Save
the changes.
Commit
and
Push
your configuration.
After the onboarding process completes, and make a note of the value in the
Service IP
field.

Set up Network Connectivity from your Azure Virtual Network

In Azure, create a local network gateway.

In the

Search resources, services, and docs

search box, type

local network gateways

.

Click

+Add

.

Enter the following values in the text box that displays.

Enter a
Name
for the gateway.
Enter an
IP address
. Use the
Service IP Address
from the remote network in Prisma Access in step 7.
Check
Configure BGP settings
and enter a unique
Autonomous system number (ASN)
and
BGP peer IP address
.
Enter a
Subscription
,
Resource group
, and
Location
for the gateway.

Click

Create

.



Create a virtual network connection.

Navigate to and open the page for the virtual network gateway you created when you configured a virtual network and virtual network gateway on Azure.

See the Microsoft Azure documentation for details.

On the page for the virtual network gateway, click

Connections

. At the top of the Connections page, click

+Add

to open the Add connection page.

Enter values for the new connection, then click

OK

.

In the

Shared key (PSK)

field, use the same

Pre-shared Key

that you used when you created the IKE gateway in Prisma Access.

Click

OK

.



Add a new route table to use for BGP routing.

Select

+Create a resource

on the upper left corner of the Azure portal.

Select

Networking

, then select

Route table

.

Add a

Name

,

Subscription

,

Resource Group

, and

Location

.

Set

BGP route propagation

to

Enabled

.

Click

Create

.



Associate a subnet to the route table you created.

Open the route table you created.
Select
Settings
Subnets
.
Click
Associate
to add a subnet.
In the
Associate subnet
column, click
Virtual network
.
Select the virtual network you created when you configured a virtual network and virtual network gateway on Azure.
Click
OK
.

Verify Remote Network Connectivity

In Azure, select the
Connection
you created and click
Overview
.
The tunnel should show a status of
Connected
.

Verify that the BGP routes are being advertised on Azure.
Open the route table you just created.
Select
Networking
Settings
.
Select the name of a network interface.
Select
Support + troubleshooting
Effective routes
.
Verify that the BGP routes are being advertised.

Check the remote network and BGP status in Prisma Access.
In Strata Cloud Manager, select
Workflows
Prisma Access Setup
Remote Networks
.
The
Config Status
should be
In Sync
and verify the BGP Status in
Routing Information
.

Secure Internet-Bound Traffic with Prisma Access

Log into your PowerShell console with elevated privileges, and connect to your account.

Create a new route table by entering the following commands:

> 
New-AzureRmRouteTable -Name "DefRouteTable" -ResourceGroupName "GPCS-PM-TME" -Location "WEST US"

> 
$rt = Get-AzureRmRouteTable -Name "DefRouteTable" -ResourceGroupName "GPCS-PM-TME"

> 
Add-AzureRmRouteConfig -Name "DefaultRoute" -AddressPrefix "0.0.0.0/0" -NextHopType VirtualNetworkGateway -RouteTable $rt

> 
Set-AzureRmRouteTable -RouteTable $rt

Modify the subnet configuration by entering the following commands:

> 
$vnet = Get-AzureRmVirtualNetwork -Name "GPCS-Onboarding-VMNET" -ResourceGroupName "GPCS-PM-TME"

> 
Set-AzureRmVirtualNetworkSubnetConfig -Name "GPCS-O-Subnet-1" -VirtualNetwork $vnet -AddressPrefix "10.200.1.0/24" -RouteTable $rt

> 
Set-AzureRmVirtualNetwork -VirtualNetwork $vnet

Enable the default route for the network gateway default site by entering the following commands.

> 
$LocalGateway = Get-AzureRmLocalNetworkGateway -Name "GPCS-Gateway-US-WEST" -ResourceGroupName "GPCS-PM-TME"

> 
$VirtualGateway = Get-AzureRmVirtualNetworkGateway -Name "GPCS-Onboarding-Gateway" -ResourceGroupName "GPCS-PM-TME"

> 
Set-AzureRmVirtualNetworkGatewayDefaultSite -GatewayDefaultSite $LocalGateway -VirtualNetworkGateway $VirtualGateway