Understand Service and Data Center Groups
Table of Contents
Understand Service and Data Center Groups
Lets try to understand service and data center groups
in Prisma SD-WAN Zscaler CloudBlades.
Prisma SD-WAN uses mapping of Standard
VPN services and Prisma SD-WAN data centers to allow flexibility
when creating network policy rules, while accounting for uniqueness
across sites. For example, an administrator may want to create a
single network policy that directs all HTTP and SSL Internet bound
traffic through the closest Zscaler Enforcement Node (ZEN) in the
region if it is available and meets the application SLA, but if
not, may leverage a Prisma SD-WAN Data Center site as a transit
point.
This is where the concept of endpoints, groups,
and domains come into play. To leverage the underlying resources
available to an administrator, it is important to understand how
an endpoint, group, and domain work in the Prisma SD-WAN system.
Endpoint - A service endpoint is a label representing
a specific location or network service. It can be of type Prisma
SD-WAN, specifically Prisma SD-WAN Data Centers for Data Center
transit services, or of type Standard VPN. In this release, the
only Standard VPN service that can be configured VarPeN s to cloud security
services. However, in a subsequent release, there could be other
network services that would use this same construct.
Group - A service group is label representing a set of
common service endpoint types. This service group label will be
used in network policy rules to express intent to allow or force
traffic to the defined service endpoint(s). It can be of type Prisma
SD-WAN or Standard VPN and may contain zero or more service endpoints.
Domain - A domain is a collection of groups which can
be assigned to a set of sites. There can be multiple domains defined,
but a site may only be assigned to one domain at a time.
A site will be able to use only the endpoints configured
in a group within a domain that is assigned to the site. The same
group, however, can be in multiple domains with different service
endpoints, allowing you to use the same policy across different
sites utilizing different endpoints.
Let us further explore the concept of endpoints, groups, and
domains using the following illustration and screenshot.
The illustration displays how endpoints added to a group are
associated with a domain. The domains are then bound to a site,
thus mapping Standard VPN services or Prisma SD-WAN data centers
uniquely for each site. Note that a group, with different endpoints,
can be mapped to one or more domains and a domain can be mapped
to one or more sites.
Another example to illustrate the concept is shown below as a
screenshot. For a customer with sites in North America and Europe
that has one Prisma SD-WAN-enabled data center in each region and
has adopted Zscaler within each region the domain mapping is accomplished
as follows:
- The Zscaler CloudBlade creates a single group Zscaler with a single Standard VPN Endpoint.
- The Standard VPN endpoint has all possible Zscaler hostnames, and based on a latency check, the ION will build a VPN tunnel to the closest ZEN.
- From version 2.0.0, the Zscaler CloudBlade creates two groups; Zscaler GRE Primary and Zscaler GRE Backup.
- The same endpoint can be added to more than one group.
- Only one active group and one backup group may be used in a network policy rule.