Validate the AWS Transit Gateway Integration CloudBlade

1. Check the status indicator on the CloudBlade window.

   Once enabled and deployed correctly, the status indicator should turn green.

   If the access credentials are invalid, the status indicator will throw an Invalid AWS credentials error message.

2. Check if the Prisma SD-WAN data center site has been created in the AWS cloud and if the vION HA pair has been assigned to this site.

3. Go to the Active ION’s Interfaces configuration window and check if the GRE VPN has been created.

   1. Click on the interface to check the IP address configuration.
   2. Go to the 2nd ION’s interface configuration window and check the GRE tunnel interface configuration.
4. Check if the core BGP peering between each vION and the Transit Gateway Connect peer is UP.
5. Check if both the vIONs have learned the prefixes from the Application VPC behind the AWS Transit Gateway and the active ION has learned and advertised the routes.

Setup Application Path Policy Rules

Once the CloudBlade configures the appropriate entities within Prisma SD-WAN, the administrator can configure path policies to allow the ION devices to make intelligent per-app path selections.

The Prisma SD-WAN Secure Application Fabric (AppFabric) enables granular controls for virtually an unlimited number of policy permutations down to the sub-application level. Below is an example of configuring a path policy rule to use the Prisma SD-WAN VPN to the AWS DC ION.

In Strata Cloud Manager, go ConfigurationPrisma SD-WANPoliciesPaths and choose a policy set of interest. Within the policy set, click the Add Rule and define the following: name, network contexts, destination, prefixes or apps of interest (or a combination of both apps and prefixes), active and backup paths, and service and DC groups.

In this example, we will use a destination prefix-based rule since we have already defined a path prefix that matches the IP address of the service running in the AWS Application VPC.