Cloud Identity Engine Disaster Recovery
How the Cloud Identity Engine fails over when a Google Cloud zone or region becomes
unavailable.
| Where Can I Use This? | What Do I Need? |
|---|
- Prisma Access (Managed by Strata Cloud Manager)
- NGFW (Managed by Strata Cloud Manager)
- NGFW (Managed by PAN-OS or Panorama)
| No prerequisites needed |
When a Google Cloud zone or region becomes unavailable, the Cloud Identity Engine
automatically fails over to another zone or region, ensuring authentication and
identity-based policy enforcement continue uninterrupted. The Cloud Identity Engine
supports both zonal and regional disaster recovery (DR).
Zonal Disaster Recovery
If a zone becomes unavailable, the Cloud Identity Engine automatically fails over to
another zone in the same region. This keeps your identity data accessible without
any action on your part. The Cloud Identity Engine supports zonal DR by default for
all
CIE regions.
Regional Disaster Recovery
If a primary region becomes unavailable (for example, due to a GCP regional outage),
the Cloud Identity Engine fails over to a secondary region. To protect data
sovereignty, the secondary region resides within the same country as the primary
region.
To disable regional DR for your deployment, contact Palo Alto Networks Support.
Regional DR is available for the following regions:
| Country | Primary GCP Region | Secondary GCP Region |
|---|
| United States | us-central1 | us-west1 |
| Germany | europe-west3 | europe-west10 |
| Canada | northamerica-northeast1 | northamerica-northeast2 |
| Japan | asia-northeast1 | asia-northeast2 |
