Redistribute User-ID Information From an On-Premises Firewall to
Prisma Access
Shows the steps you use to redistribute User-ID information
from an on-premises firewall to Prisma Access.
In cases where users are at a branch location
or HQ that is secured by an on-premises next-generation firewall
with user-based policies, and they need to access resources at another
branch location that you have secured with Prisma Access, you must redistribute IP address-to-user
name mappings from the on-premises firewall to Prisma Access.
The
following figure shows an HQ/Data center with an on-premises next-generation
firewall with existing IP address-to-username mapping. Prisma Access connects
to the firewall with either a service connection (SC-CAN) or remote
network connection (RN-SPN), and the on-premises firewall redistributes
the mapping to Prisma Access.
The following figure shows a
Prisma Access service connection or remote network connection being
used to redistribute the mapping. You can use any route path over
an IPSec trusted tunnel for privately addressed destinations to
redistribute this mapping.
To redistribute
User-ID mappings from an on-premises firewall to Prisma Access,
complete the following steps.