Connector Groups and Application Onboarding
Connector Groups and Application Onboarding
Connector Group Setup
In Strata Cloud Manager, navigate to Configuration > ZTNA Connector > Connector
Groups. Create a Connector Group specifying NGFW Connector as the Group
Type. Next, go to NGFW Connectors > Create NGFW Connector, select your target
Connector Group, attach your firewall serial number, and click Create.
Application Onboarding (FQDN Targets)
- Define specific private applications using single FQDNs or explicit IP addresses
with target ports and probing types.
- ZTNA Connector generates dynamic static routes, path monitoring probes, and FQDN
NAT rules.
- Management interfaces automatically synchronize and commit configurations to
your target NGFWs.
- Path monitoring validates reachability and advertises application routes to
Prisma Access via BGP.
Wildcard Application Discovery and Onboarding- Configure wildcard domain patterns (e.g., .example.com) in Strata Cloud Manager.
- The NGFW automatically binds a DNS Proxy on a dedicated loopback interface
created during connector onboarding.
- DNS requests for wildcard targets from Prisma Access/Browser users forward to
the NGFW DNS Proxy, which resolves IPs and notifies ZTNA MS to dynamically
onboard discovered FQDN targets.
IP Subnet Targets & Overlapped Networks - IP Subnet Targets: Create IP Subnet rules in SCM by entering CIDR
notations (up to 16 non-overlapping subnets per rule). Ensure subnets do not
conflict with branch, remote network, or mobile user pools.
- Overlapped IP Handling: For applications with overlapping data center IP
subnets, enable the overlapped network checkbox during onboarding. The NGFW uses
Source NAT (SNAT) and Destination NAT (DNAT) to translate overlapping IPs while
preserving pre-NAT IP visibility in firewall logs.
Operational Best Practices & Troubleshooting
Maintain optimal operations and resolve common setup issues using these
guidance standards:
- Path Monitoring Probes: Use icmp ping for active path
verification. Note that configuring tcp ping behaves identically to
none for FQDN/Wildcard targets.
- High Availability & Redundancy: HA pair mode is not
supported for NGFW Connector. Achieve complete redundancy by onboarding multiple
standalone NGFW instances with unique serial numbers into the same Connector
Group.
- Monitoring & Telemetry: Monitor tunnel state, BGP routes,
and application reachability directly in Strata Cloud Manager under ZTNA
Overview. Detailed CPU/Memory and infrastructure health metrics are available in
Strata Insights under Insights > Data Center > ZTNA Connector.
- Safe De-boarding Procedure: When removing connectors, delete individual
NGFW Connectors from the ZTNA Connector Group in SCM. Configuration cleanup on
the management interface occurs automatically when the last connector in a group
is deleted.
