>
    Strata Copilot
    NGFW ZTNA Connector Integration
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Browser
    3. First-Party Integrations
    4. NGFW ZTNA Connector Integration
    Download PDF
    Prisma Browser

    NGFW ZTNA Connector Integration

    Table of Contents

    NGFW ZTNA Connector Integration

    This document describes how to integrate NGFW with ZTNA connector integration
    Where Can I Use This?What Do I Need?
    • PAN-OS ® version 12.1.5 and later
      • Prisma Access (Managed by Panorama)
      • Prisma Access (Managed by Strata Cloud Manager)
      • NGFW (Hardware and VM-Series
    NGFW ZTNA Connector Integration leverages your Palo Alto Networks® Next-Generation Firewalls (VM-Series and Hardware NGFW) as Zero Trust Network Access (ZTNA) Connectors. This provides secure, automated connectivity to private applications in data centers for Prisma Access mobile, contractor, branch, and Prisma Browser users. You can centrally manage NGFW Connectors using either Panorama or Strata Cloud Manager.

    Deployment Prerequisites & System Requirements

    Before deploying NGFW ZTNA Connector Integration, review the platform, software, and licensing requirements:
    • Supported Platforms & Operating System: PAN-OS® version 12.1.5 and later running on Hardware NGFW or VM-Series instances.
    • Prisma Access & Management Versions: Prisma Access version 6.1 or later. For Panorama-managed environments, Cloud Services Plugin (CSP) version 6.1 or later is required. For Strata Cloud Manager deployments, Prisma Access 6.2 and SCM r3.0/Strata Cloud Manager license with AIOps for NGFW are required.
    • Device Licensing & Certificates: Valid PA-VM or Hardware NGFW license and active Device Certificate installed from the Palo Alto Networks Support Portal.
    • Network Architecture Requirements: Layer 3 WAN interface with default Virtual Router (VR) mode. Advanced routing (Logical Router/LR) and High Availability (HA) state pairs are not supported for NGFW Connector. A routable loopback IP address must be configured in your data center network.

    Architecture and Core Components

    Core Components
    • Palo Alto Networks NGFW — Your NGFW (VM-Series or Hardware) serves as the ZTNA Connector securing private data center applications. It establishes automated IKEv2 IPSec tunnels to Prisma Access ZTNA Tunnel Terminators (ZTTs) and enforces security policies.
    • Management Interface (Panorama or Strata Cloud Manager) — Orchestrates configuration deployment and synchronization. For Panorama, the Cloud Services Plugin (CSP) synchronizes settings with Prisma Access. For Strata Cloud Manager, automatic registration occurs when the NGFW and tenant share the same account.
    • Prisma Access Cloud Control Plane (ZTNA MS) — Cloud-based management service that orchestrates ZTNA Connectors, creates Connector Groups, generates dynamic configuration (IPSec, BGP, NAT rules), and provisions target application access.
    • Applications & Targets — Private data center resources defined by FQDN, wildcard FQDN, or IP subnet. Reachability and health are dynamically advertised using BGP route exchanges and path monitoring probes.
    Architectural Data & Control Flow
    The architectural workflow integrates the cloud control plane and local data center enforcement:
    • Control Plane Orchestration: ZTNA Management Service generates IPSec, BGP, loopback IP, NAT, and security policy rules, pushing them to Panorama or Strata Cloud Manager, which automatically applies them to managed NGFWs.
    • Secure Tunnels (ZTT): The NGFW establishes redundant IPSec tunnels to Prisma Access ZTNA Tunnel Terminators (ZTT) in the closest cloud region based on geographic coordinates.
    • Traffic Path: User traffic flows seamlessly: Client (GlobalProtect Mobile User, Remote Network, or Prisma Browser) → Dataplane/ZTT → IPSec Tunnel → NGFW ZTNA Connector → Data Center Router → Application Server.

    Connector Group Setup

    In Strata Cloud Manager, navigate to Configuration > ZTNA Connector > Connector Groups. Create a Connector Group specifying NGFW Connector as the Group Type. Next, go to NGFW Connectors > Create NGFW Connector, select your target Connector Group, attach your firewall serial number, and click Create.
    Application Onboarding (FQDN Targets)
    This process defines and configures access for specific private applications using FQDNs and ports, enabling users to securely reach explicitly defined applications behind the NGFW Connector.
    • You specify the application's FQDN or IP address, port range, and probe type in Prisma Access.
    • For each NGFW Connector in the group, ZTNA Connector creates application -specific configuration, including static routes, application probes, and FQDN-based NAT rules.
    • This configuration is published to the management interface, which then pulls and commits it to your NGFW.
    • Your NGFW advertises the application's reachability to Prisma Browser Connector via BGP, based on continuous path monitoring results.
      Management interfaces automatically synchronize and commit configurations to your target NGFWs.
    Wildcard Application Discovery and Onboarding
    This mechanism dynamically discovers and onboards applications within a specified wildcard domain, simplifying management for environments with numerous or frequently changing applications.
    • You configure Prisma Browser Connector to onboard wildcard-based applications.
    • Your NGFW enables a DNS Proxy on a dedicated loopback interface, created by the ZTNA Connector during connector onboarding.
    • DNS requests from Prisma BrowserAccess users for wildcard applications are forwarded to this DNSProxy on your NGFW.
    • Your NGFW resolves the DNS request and sends the reply back to the Prisma Browser Connector which notifies ZTNA Connector about the newly discovered application.
    • ZTNA Connector then onboards this application, generating and pushing necessary NAT,routing, and probe configurations to your NGFW via the management interface.

    © 2026 Palo Alto Networks, Inc. All rights reserved.