Configure IKE, IPSec, and BGP and Onboard the Azure VNet in Prisma Access

In Strata Cloud Manager, select
Workflows
Prisma Access Setup
Remote Networks
.
(
Optional
) If you have not already, allocate bandwidth for the remote network under
Bandwidth Management
.
You allocate bandwidth by selecting bandwidth for the remote network’s compute location. Select an
Assigned Bandwidth
for the remote network’s compute location.
Go to
Remote Networks
and
Add Remote Networks
.

Give the remote network a descriptive
Site Name
.
Select the
Prisma Access Location
that is closest to your Azure VNet.
Select the
IPSec Termination Node
to use for the remote network.
Enable
ECMP Load Balancing
.
Set up the IPSec tunnel for the Azure gateway.
Set Up
the primary tunnel.

Select an existing tunnel, or select
Create New
to create a new tunnel.

Give the tunnel a descriptive
Name
.
Select the
Branch Device Type
for the IPSec device at the remote network site that you’re using to establish the tunnel with Prisma Access.
Specify a
Pre-Shared Key
.
Specify a
Branch Device IP Address
of either
Static IP
or
Dynamic IP
.
Setting up an
IKE Peer Identification
is required if you use a dynamic IP address. If you select
Static IP
, enter a static IP address.
Select
IKE Advanced Options
, create an IPSec crypto profile for the IPSec tunnel, and
Save
the changes.
The IPSec crypto settings you specify here must match the settings you specify on Azure. To set IKE and IPSec policies in Azure, see the Microsoft Azure documentation.
Select
IPSec Advanced Options
, create an IKEv1 crypto profile for the gateway, and
Save
the changes.
Set Up
BGP routing.
Enable BGP for Dynamic Routing
.
Enter the
Peer Address
value from Azure in the
Peer IP address
field and enter the
Autonomous system number (ASN)
value from Azure in the
Peer AS
field.
(
Optional
) Enter an address that Prisma Access uses as its
Local IP Address
for BGP.
Make sure that the address you specify does not conflict or overlap with IP addresses in the Infrastructure Subnet or subnets in the remote network.
You must configure a static route on your CPE to the BGP local address.
Save
the changes.
Commit
and
Push
your configuration.
After the onboarding process completes, and make a note of the value in the
Service IP
field.

Set up Network Connectivity from your Azure Virtual Network

In Azure, create a local network gateway.

In the

Search resources, services, and docs

search box, type

local network gateways

.

Click

+Add

.

Enter the following values in the text box that displays.

Enter a
Name
for the gateway.
Enter an
IP address
. Use the
Service IP Address
from the remote network in Prisma Access in step 7.
Check
Configure BGP settings
and enter a unique
Autonomous system number (ASN)
and
BGP peer IP address
.
Enter a
Subscription
,
Resource group
, and
Location
for the gateway.

Click

Create

.



Create a virtual network connection.

Navigate to and open the page for the virtual network gateway you created when you configured a virtual network and virtual network gateway on Azure.

See the Microsoft Azure documentation for details.

On the page for the virtual network gateway, click

Connections

. At the top of the Connections page, click

+Add

to open the Add connection page.

Enter values for the new connection, then click

OK

.

In the

Shared key (PSK)

field, use the same

Pre-shared Key

that you used when you created the IKE gateway in Prisma Access.

Click

OK

.



Add a new route table to use for BGP routing.

Select

+Create a resource

on the upper left corner of the Azure portal.

Select

Networking

, then select

Route table

.

Add a

Name

,

Subscription

,

Resource Group

, and

Location

.

Set

BGP route propagation

to

Enabled

.

Click

Create

.



Associate a subnet to the route table you created.

Open the route table you created.
Select
Settings
Subnets
.
Click
Associate
to add a subnet.
In the
Associate subnet
column, click
Virtual network
.
Select the virtual network you created when you configured a virtual network and virtual network gateway on Azure.
Click
OK
.

Verify Remote Network Connectivity

In Azure, select the
Connection
you created and click
Overview
.
The tunnel should show a status of
Connected
.

Verify that the BGP routes are being advertised on Azure.
Open the route table you just created.
Select
Networking
Settings
.
Select the name of a network interface.
Select
Support + troubleshooting
Effective routes
.
Verify that the BGP routes are being advertised.

Check the remote network and BGP status in Prisma Access.
In Strata Cloud Manager, select
Workflows
Prisma Access Setup
Remote Networks
.
The
Config Status
should be
In Sync
and verify the BGP Status in
Routing Information
.

Secure Internet-Bound Traffic with Prisma Access

Log into your PowerShell console with elevated privileges, and connect to your account.

Create a new route table by entering the following commands:

> 
New-AzureRmRouteTable -Name "DefRouteTable" -ResourceGroupName "GPCS-PM-TME" -Location "WEST US"

> 
$rt = Get-AzureRmRouteTable -Name "DefRouteTable" -ResourceGroupName "GPCS-PM-TME"

> 
Add-AzureRmRouteConfig -Name "DefaultRoute" -AddressPrefix "0.0.0.0/0" -NextHopType VirtualNetworkGateway -RouteTable $rt

> 
Set-AzureRmRouteTable -RouteTable $rt

Modify the subnet configuration by entering the following commands:

> 
$vnet = Get-AzureRmVirtualNetwork -Name "GPCS-Onboarding-VMNET" -ResourceGroupName "GPCS-PM-TME"

> 
Set-AzureRmVirtualNetworkSubnetConfig -Name "GPCS-O-Subnet-1" -VirtualNetwork $vnet -AddressPrefix "10.200.1.0/24" -RouteTable $rt

> 
Set-AzureRmVirtualNetwork -VirtualNetwork $vnet

Enable the default route for the network gateway default site by entering the following commands.

> 
$LocalGateway = Get-AzureRmLocalNetworkGateway -Name "GPCS-Gateway-US-WEST" -ResourceGroupName "GPCS-PM-TME"

> 
$VirtualGateway = Get-AzureRmVirtualNetworkGateway -Name "GPCS-Onboarding-Gateway" -ResourceGroupName "GPCS-PM-TME"

> 
Set-AzureRmVirtualNetworkGatewayDefaultSite -GatewayDefaultSite $LocalGateway -VirtualNetworkGateway $VirtualGateway

Configure IKE, IPSec, and BGP and Onboard the Azure VNet in Prisma Access

In Panorama, select

Remote_Network_Template

from the

Template

drop-down.

Select

Network

Network Profiles

IKE Crypto

and

Add

an IKE crypto profile for the gateway.

Make a note of these settings; the IKE crypto settings you specify here must match the settings you specify on Azure. To set IKE and IPSec policies in Azure, see the Microsoft Azure documentation. The screenshot in the following figure uses the following settings:

DH Group
:
group2
Encryption
:
aes-256-cbc
Authentication
:
sha1
Key Lifetime
:
8 Hours



Select

Network

Network Profiles

IPSec Crypto

and

Add

an IPSec crypto profile for the IPSec tunnel.

The IPSec crypto settings you specify here must match the settings you specify on Azure; to set IKE and IPSec policies in Azure, see the Microsoft Azure documentation. The screenshot in the following figure uses the following settings:

IPSec Protocol
:
ESP
DH Group
:
no-pfs
Lifetime
:
8 Hours
Encryption
:
aes-256-gcm
Authentication
:
none



Select

Network

Network Profiles

IKE Gateways

and

Add

an IKE gateway.

In the
General
tab, change the
Peer ID Address Type
to
IP
.
In the
Peer Address
field, enter the
Public IP address
from the
Overview
screen on Azure.
Enter a
Pre-shared Key
.
Make a note of this key. You use it later when you Set up Network Connectivity from your Azure Virtual Network.
Click
OK
.



Select

Network

IPSec Tunnels

and

Add

an IPSec tunnel for the Azure gateway, specifying the

IKE gateway

and

IPSec Crypto Profile

that you created earlier in this task.



Select

Panorama

Cloud Services

Configuration

Remote Networks

and

Add

the Azure VPN as a remote network.

Specify the following choices:

Select a
Location
that is closest to your Azure VNet.
Select the
IPSec Termination Node
that you want to use for this remote network.
Prisma Access uses this node to associate remote network locations with compute locations.
Specify the IPSec primary tunnel that you just created in the
IPSec Tunnel
field.



Configure BGP routing.

Click the
BGP
tab.
Enter the
Autonomous system number (ASN)
value from Azure in the
Peer AS
field and enter the
Peer Address
value from Azure in the
BGP peer IP address(es)
field.
(
Optional
) Enter an address that Prisma Access uses as its
Local Address
for BGP.
Make sure that the address you specify does not conflict or overlap with IP addresses in the Infrastructure Subnet or subnets in the remote network.
You must configure a static route on your CPE to the BGP
Local Address
.
Click
OK
.



Commit

and

Push

your configuration.

After the onboarding process completes, select

Panorama

Cloud Service

Status

Network Details

Remote Networks

and make a note of the value in the

Service IP Address

field.

Set up Network Connectivity from your Azure Virtual Network

In Azure, create a local network gateway.

In the

Search resources, services, and docs

search box, type

local network gateways

.

Click

+Add

.

Enter the following values in the text box that displays.

Enter a
Name
for the gateway.
Enter an
IP address
. Use the
Service IP Address
from the remote network in Prisma Access (
Panorama
Cloud Service
Status
Network Details
Remote Networks
).
Check
Configure BGP settings
and enter a unique
Autonomous system number (ASN)
and
BGP peer IP address
.
Enter a
Subscription
,
Resource group
, and
Location
for the gateway.

Click

Create

.



Create a virtual network connection.

Navigate to and open the page for the virtual network gateway you created when you configured a virtual network and virtual network gateway on Azure.

See the Microsoft Azure documentation for details.

On the page for the virtual network gateway, click

Connections

. At the top of the Connections page, click

+Add

to open the Add connection page.

Enter values for the new connection, then click

OK

.

In the

Shared key (PSK)

field, use the same

Pre-shared Key

that you used when you created the IKE gateway in Prisma Access.

Click

OK

.



Add a new route table to use for BGP routing.

Select

+Create a resource

on the upper left corner of the Azure portal.

Select

Networking

, then select

Route table

.

Add a

Name

,

Subscription

,

Resource Group

, and

Location

.

Set

BGP route propagation

to

Enabled

.

Click

Create

.



Associate a subnet to the route table you created.

Open the route table you created.
Select
Settings
Subnets
.
Click
Associate
to add a subnet.
In the
Associate subnet
column, click
Virtual network
.
Select the virtual network you created when you configured a virtual network and virtual network gateway on Azure.
Click
OK
.

Verify Remote Network Connectivity

In Azure, select the

Connection

you created and click

Overview

.

The tunnel should show a status of

Connected

.



Verify that the BGP routes are being advertised on Azure.

Open the route table you just created.
Select
Networking
Settings
.
Select the name of a network interface.
Select
Support + troubleshooting
Effective routes
.
Verify that the BGP routes are being advertised.



Check the remote network and BGP status in Prisma Access.

In Panorama, select

Panorama

Cloud Services

Status

Monitor

Remote Networks

Status

.

The

Config Status

should be

In Sync

and the

BGP Status

should be

Established

.

Secure Internet-Bound Traffic with Prisma Access

Log into your PowerShell console with elevated privileges, and connect to your account.

Create a new route table by entering the following commands:

> 
New-AzureRmRouteTable -Name "DefRouteTable" -ResourceGroupName "GPCS-PM-TME" -Location "WEST US"

> 
$rt = Get-AzureRmRouteTable -Name "DefRouteTable" -ResourceGroupName "GPCS-PM-TME"

> 
Add-AzureRmRouteConfig -Name "DefaultRoute" -AddressPrefix "0.0.0.0/0" -NextHopType VirtualNetworkGateway -RouteTable $rt

> 
Set-AzureRmRouteTable -RouteTable $rt

Modify the subnet configuration by entering the following commands:

> 
$vnet = Get-AzureRmVirtualNetwork -Name "GPCS-Onboarding-VMNET" -ResourceGroupName "GPCS-PM-TME"

> 
Set-AzureRmVirtualNetworkSubnetConfig -Name "GPCS-O-Subnet-1" -VirtualNetwork $vnet -AddressPrefix "10.200.1.0/24" -RouteTable $rt

> 
Set-AzureRmVirtualNetwork -VirtualNetwork $vnet

Enable the default route for the network gateway default site by entering the following commands.

> 
$LocalGateway = Get-AzureRmLocalNetworkGateway -Name "GPCS-Gateway-US-WEST" -ResourceGroupName "GPCS-PM-TME"

> 
$VirtualGateway = Get-AzureRmVirtualNetworkGateway -Name "GPCS-Onboarding-Gateway" -ResourceGroupName "GPCS-PM-TME"

> 
Set-AzureRmVirtualNetworkGatewayDefaultSite -GatewayDefaultSite $LocalGateway -VirtualNetworkGateway $VirtualGateway

Troubleshoot the Site-to-Site Connection