Onboarding Workflow for Prisma Access ZTNA Connector

1. Go to WorkflowsOnboarding.
2. Configure connectivity to private apps.

3. Create a ZTNA Connector.

4. Create a Connector Group.

   1. Add Connector Group, give the Connector Group a unique Name, and select the Group Type as ZTNA Connector.
   2. (Optional) Add a Description and enable Preserve User ID, if required.
   3. Create to add the Connector Group, and then select Next.

5. Create a Connector.

   1. Give the Connector a unique Name.
   2. Select the Connector Group and optionally add a Description for the Connector, and then select Next.

6. Configure Application Targets.

   1. Select the add icon to add a FQDN Target or a Wildcard Target.

   2. Configure an FQDN Target:

      1. Add a unique Name for the target and assign a Connector Group to associate with the target. The Group must be a type of FQDN/Wildcard.
      2. Add the FQDN to use with the target.
      3. Enable Microsoft AD Firewall Ports, if you want to enable all TCP and UDP ports required for Microsoft Active Directory Domain Services.
      4. Select the Protocol (tcp, udp or both).
      5. (Optional) To enable ICMP protocol from a GlobalProtect user to a ZTNA Connector data center Allow ICMP Protocol.
      6. Select the Port to use for the app.
         Enter ports in one or more of these formats:

         • A single port
         • Multiple ports using commas between the ports
         • A range of ports using dashes
         • A range of ports using commas and dashes
         If you have selected both under Protocol, add ports to TCP Port and UDP Port.
         When you enter a range in the TCP Port field, under Advanced Settings, icmp ping and Probing Type of none are activated.
      7. Enter a Probing Type of tcp ping, icmp ping, or none, depending on the protocol you select.
         If you select tcp ping, select a Probing Port, and enter a single port. The port does not have to be in the range of ports you entered in the Port and Protocol area. ZTNA Connector determines the reachability of the app by performing a TCP ping from the probing port to the FQDN's resolved IP address. If the ping is successful, the app is considered Up.
         You can also edit the probing port, which you have added during application onboarding. When the probe port is updated, ZTNA Connector starts a TCP probing application on the updated port and the application status is updated accordingly.
         If you select icmp ping, ZTNA Connector performs an ICMP ping to the FQDN's resolved IP address. When a response is received to the ICMP ping, the app is considered Up. If you select none, no probing is performed and the application is always marked as Up.
      8. Select Enabled to create the target.
      9. (Optional) Enable Keep Data Center IP Address.
         Normally, FQDN targets are allocated an IP address from the ZTNA Connector IP Blocks and DNS Proxies. However, Microsoft Active Directory DS applications won't function properly with DNS Proxy NAT. FQDN targets with Keep Data Center IP Address keep the data center IP address resolved at the ZTNA Connector DNS Server. DNS Resolution must be consistent with no overlapping IP addresses.
      10. Create to add the required FQDN target.

   3. Configure a Wildcard Target:

      1. Add a unique Name for the target and assign a Connector Group to associate with the target. The Group must be a type of FQDN/Wildcard.
      2. Add the Wildcard to use with the target.
         Enter it in the format of .example.com or .my.example.com (the UI implicitly adds the asterisk to the front of the wildcard). Don't allow all sites by specifying a wildcard of *.*, example.*.com, or *.com.
      3. Enable Microsoft AD Firewall Ports, if you want to enable all TCP and UDP ports required for Microsoft Active Directory Domain Services.
      4. Select the Protocol (tcp, udp or both).
      5. (Optional) To enable ICMP protocol from a GlobalProtect user to a ZTNA Connector data center Allow ICMP Protocol.
      6. Select the Port to use for the app.
         Enter ports in one or more of these formats:

         • A single port
         • Multiple ports using commas between the ports
         • A range of ports using dashes
         • A range of ports using commas and dashes
         If you have selected both under Protocol, you have to add ports to TCP Port and UDP Port.
         When you enter a range in the TCP Port field, under Advanced Settings, icmp ping and Probing Type of none are activated.
      7. Enter a Probing Type of tcp ping, icmp ping, or none, depending on the protocol you select.
         If you select tcp ping, select a Probing Port, and enter a single port. The port does not have to be in the range of ports you entered in the Port and Protocol area. ZTNA Connector determines the reachability of the app by performing a TCP ping from the probing port to the FQDN's resolved IP address. If the ping is successful, the app is considered Up.
         You can also edit the probing port, which you have added during application onboarding. When the probe port is updated, ZTNA Connector starts a TCP probing application on the updated port and the application status is updated accordingly.
         If you select icmp ping, ZTNA Connector performs an ICMP ping to the FQDN's resolved IP address. When a response is received to the ICMP ping, the app is considered Up. If you select none, no probing is performed and the application is always marked as Up.
      8. Select Activated to create the target.
      9. (Optional) Enable Keep Data Center IP Address.
         Normally, FQDN targets are allocated an IP address from the ZTNA Connector IP Blocks and DNS Proxies. However, Microsoft Active Directory DS applications won't function properly with DNS Proxy NAT. FQDN targets with Keep Data Center IP Address keep the data center IP address resolved at the ZTNA Connector DNS Server. DNS Resolution must be consistent with no overlapping IP addresses.
      10. Create to add the required Wildcard target and select Next.

7. Retrieve the key and token to set up and activate and authenticate the connectors. For advanced monitoring and troubleshooting, navigate to WorkflowsZTNA ConnectorConnectors.

8. Complete the setup by deploying your ZTNA Connector VMs in your data center.
9. Navigate to ManageConfigurationNGFW and Prisma Access to create a Security policy under the Prisma Access configuration scope to control user access to the applications that ZTNA Connector discovers.
10. Create security policy rules to allow users access to the apps in the connectors.
11. Finish to complete the onboarding process.
12. Push Config to push your configuration changes.
13. (Optional) View Monitor: Data Centers ZTNA Connectors to see how your ZTNA connectors and connector groups are performing.
14. (Optional) If you encounter issues with accessing private apps using ZTNA Connector, use the ping, traceroute, and nslookup diagnostic tools to check app reachability.