Focus

Zscaler Internet Access CloudBlade Integration Guide

Use Groups in Network Policy Rules

Table of Contents

Use Groups in Network Policy Rules

Lets see how to use groups in Network policy rules.

Before you can use a Standard VPN in a policy rule, you need to define service endpoint groups. Each group can have one or more Prisma SD-WAN data centers or Standard VPN service endpoints. A group will be used in policy rules. The domain defining the mappings for endpoints to groups must be assigned to a site for the policy rules using the group to be effective. For more information, refer to Managing Services and Data Center Groups.

There can be four combinations of Active/Backup groups that can be used in Policies. You may select just one Prisma SD-WAN group or one non-Prisma SD-WAN group as an active or backup path in policies. For example:

Active Group	Backup Group	Example
Standard VPN	Prisma SD-WAN	Internet-bound SSL traffic from a branch site will transit through the Cloud Security Service. In the event all Standard VPN paths to any of the endpoints in the Primary Cloud Security Service group are not available, internet-bound SSL traffic will transit through one of the Prisma SD-WAN data center endpoints assigned to that via the Prisma SD-WAN VPN.
Prisma SD-WAN	Standard VPN	Internet-bound SSL traffic from a branch site will transit through one of the Prisma SD-WAN data center endpoints assigned to that group via the Prisma SD-WANs.In the event all Prisma SD-WAN VPNs to all of the Data Center endpoints in group are unavailable, internet-bound SSL traffic will transit through the Cloud Security Service via one of the Standard VPN paths to any of the endpoints in the Standard VPN group.
Standard VPN	Standard VPN	Internet-bound SSL traffic from a branch site will transit through the primary cloud security service via one of the Standard VPN paths to any of the endpoints in the primary cloud security service group. In the event all Standard VPNs are down to all endpoints in the primary group, the Internet bound SSL traffic will transit through the backup cloud security service via one of the Standard VPN paths to the endpoints that are part of the backup group.
Prisma SD-WAN	Prisma SD-WAN	Internet-bound SSL traffic from a branch site will transit through one of the Prisma SD-WAN data center endpoints assigned to the active group via the VPNs. In the event all Prisma SD-WAN VPNs to all of those endpoints are down,internet-bound SSL traffic will transit through one of the Prisma SD-WAN data center endpoints assigned to the backup group via the Prisma SD-WAN VPNs.

Assign Domains to Sites

Use a Group in Stacked Policies

Zscaler Internet Access CloudBlade Integration Guide

Use Groups in Network Policy Rules

Use Groups in Network Policy Rules

Recommended For You