>
    Strata Copilot
    Configure Secure Inbound Access for Site-Based License Deployments
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access
    3. Prisma Access Administration
    4. Prisma Access Advanced Deployments
    5. Prisma Access Remote Network Advanced Deployments
    6. Provide Secure Inbound Access to Remote Network Locations
    7. Configure Secure Inbound Access for Remote Network Sites
    8. Configure Secure Inbound Access for Site-Based License Deployments
    Download PDF
    Prisma Access

    Configure Secure Inbound Access for Site-Based License Deployments

    Table of Contents

    Configure Secure Inbound Access for Site-Based License Deployments

    Learn how to configure secure access to apps that are located in remote network branches.
    Where Can I Use This?What Do I Need?
    • Prisma Access (Managed by Strata Cloud Manager)
    • Minimum of Prisma Access 6.1 Preferred and Innovation
    • Prisma Access site-based license for remote networks
    Site-based licensing for Remote Networks enhances flexibility and simplifies deployment for branch sites. This licensing model lets you allocate your sites with predefined bandwidth capacities. By moving away from aggregate bandwidth-based licensing, you can more easily estimate and allocate resources for your remote locations.
    Site-based licensing introduces several key enhancements to improve your organization's Prisma Access experience:
    • Support for Large Branch Offices—With Large (1 Gbps) and X-Large (2.5 Gbps) site types, you can now effectively secure and connect large branch locations with high-bandwidth requirements.
    • Egress NAT Support—All site licenses include egress NAT capabilities, allowing for more flexible network address translation configurations at your remote locations.
    • Regional Redundancy Support—Your site license now includes regional redundancy at no additional charge, eliminating the need for separate redundancy configuration and providing enhanced reliability for your branch connections.

    Strata Cloud Manager

    To configure secure inbound access for Prisma Access (Managed by Strata Cloud Manager) deployments that use site-based licensing, complete this task.
    1. Go to ConfigurationNGFW and Prisma AccessConfiguration ScopeRemote NetworksBranch Sites ManagementInbound Access and Add Site.
    2. Add Site.
    3. Provide a unique Site name and select the City and Country of the site and go to the Next step when complete.
      For more precise searches, add an address.
    4. Select a location and a site type.
      1. Select a Site Type of Medium or Large.
        The site type is based on bandwidth. Secure inbound access deployments support Medium (250 Mbps) and Large (1 Gbps) sites.
      2. Select a Primary Prisma Access Location.
        If multiple locations are Recommended in the list; select the location that works best for your deployment.
        Secure inbound access deployments don't support secondary locations.
      3. Select the Number of Public IPs to use (10).
      4. (Optional) If you have a resource that is in a remote network site that has inbound access enabled and you want users at non-inbound access sites to have access to that resource, you can Allow inbound flows to other Remote Networks over the Prisma Access backbone .
      5. (Optional) To enable QoS for your site, select an existing QoS Profile. If you haven't created a QoS Profile, configure one before enabling QoS for the site. Select Next to continue.
    5. Define Tunnel & Circuit Settings.
      1. Select a Tunnel Mode of Active/Passive.
        You can configure remote networks that support secure inbound access in active/passive mode only.
      2. Select the number of Internet Circuits to use (either 1 or 2).
        If you specify one circuit, you specify one tunnel for the circuit and Prisma Access creates a single primary tunnel. If you specify two circuits, specify two tunnels and Prisma Access creates a primary active tunnel and a primary passive tunnel. If the active tunnel goes down, Prisma Access fails over to the passive tunnel.
      3. (Optional) Configure your IPSec tunnel settings.
        Prisma Access provides you with default IPSec tunnel settings. These settings determine the IPSec and IKE crypto settings for the remote network tunnel. If you want to change them, select the Primary Tunnel and Edit your settings.
        Make a note of these settings; you must match the settings on the customer premises equipment (CPE) that terminates the IPSec tunnel at your site.
        • Specify tunnel settings.
          • Specify an Authentication type (either Pre-Shared Key or Certificate).
            If you specify Pre-Shared Key, enter and confirm the Pre-Shared Key.
            If you specify a Certificate, enter the Local Certificate to use. This certificate must already exist in Strata Cloud Manager.
          • (Required for Dynamic Branch IP Addresses Only) Specify the IKE Local Identification (either IP Address, Distinguished Name (Subject), User FQDN (email address), or FQDN (hostname) .
          • (Required for Dynamic Branch IP Addresses Only) Specify the IKE Peer Identification (either IP Address, Distinguished Name (Subject), User FQDN (email address), or FQDN (hostname).
            If you specify a Dynamic branch IP address, specify either the IKE Local Identification, IKE Peer Identification, or both; at least one of those IPSec settings are required.
        • Specify the type of Peer ID Check:
          • Exact—Ensures that the local setting and peer IKE ID payload match exactly.
          • Wildcard—Allows the peer identification to match as long as every character before the wildcard (*) matches. The characters after the wildcard don't need to match.
        • (Optional) Permit peer identification and certificate payload identification mismatch to allow a successful IKE security association (SA) even when the peer identification does not match the peer identification in the certificate.
        • Choose a Certificate Profile. A certificate profile contains information about how to authenticate the peer gateway.
        • (Optional) Enable strict validation of peer’s extended key use to strictly control how the key can be used.
        • Choose the Branch Device IP Address (Static or Dynamic).
          • If you select Static, enter the Static IP Address to use for the IPSec tunnel.
          • If you specify Dynamic, which obtains the IP address automatically, specify either the IKE Local Identification, IKE Peer Identification, or both; at least one of those IPSec settings are required.
        • (Optional, Recommended) Enable IKE Passive Mode to have Prisma Access respond to IKE connections but not initiate them.
          While not required, IKE Passive Mode is the recommended setting.
        • (Optional) Turn on Tunnel Monitoring.
          Enter a Tunnel Monitoring Destination IP address on the remote network for Prisma Access to determine whether the tunnel is up and, if your branch IPSec device uses a policy-based VPN, enter the associated Proxy ID as the Monitored Proxy ID.
          Ensure that the branch device permits tunnel monitoring traffic and that the destination IP address is reachable through the IPSec tunnel.
        • (Optional) If you need a proxy ID:
          • Add Proxy ID and enter the Proxy ID.
          • Optionally, enter the Local Proxy ID and Remote Proxy ID.
          • Enter the Protocol to use for the proxy ID. Enter a Number, TCP, or UDP.
          • Specify a Local Port and Remote Port for TCP or UDP.
          • Save your changes.
        • (Optional) Specify IKE Advanced Options.
          • Select an IKE Protocol Version.
          • Select an IKEv1 Crypto Profile.
            To add a crypto profile, Add IKE. To manage an existing IKE profile, Manage IKE and select the profile to edit.
          • Select an IKEv2 Crypto Profile.
            To add a crypto profile, Add IKE. To manage an existing IKE profile, Manage IKE and select the profile to edit.
        • (Optional) Specify IPSec Advanced Options.
          • Select an IPSec Crypto Profile.
            To add a crypto profile, Add IPSec. To manage an existing IPSec profile, Manage IPSec and select the profile to edit.
      4. Go to the Next step.
    6. Choose your routing settings.
      • Select the Routing Type (either Static or Dynamic).
        If you select Static, Add the IP subnets or IP addresses that you want to secure at the site.
        If you select Dynamic:
        • Enter the Peer As (the autonomous system (AS) for your network).
          Use an RFC 6996-compliant BGP Private AS number.
        • Enter the Peer IP Address of the remote branch CPE that Prisma Access uses to establish the BGP peering session.
        • (Optional) Enter a Shared Secret password to authenticate BGP peer communications.
        • Enter the Local IP Address that Prisma Access uses as its Local IP address for BGP.
        • (Optional) Summarize Mobile User Routes before advertising to reduce the number of mobile user IP subnet advertisements over BGP to your CPE by having Prisma Access summarize the subnets before it advertises them.
        • (Optional) Advertise Default Route to have Prisma Access originate a default route advertisement for the remote network using eBGP. Be sure that your network does not have another default route advertised by BGP, or you could introduce routing issues in your network.
        • (Optional) Don't Export Routes to prevent Prisma Access from forwarding routes into the HQ or data center.
    7. Configure source NAT and publish applications hosted at the remote network site.
      1. (Optional) To disable source NAT, deselect Enable Source NAT.
        By default, source NAT is enabled. You can disable source NAT if the branch-side device and routing configuration support symmetric return traffic through Prisma Access without source translation. Ensure that the branch has the appropriate return routes before disabling source NAT.
        If the IPSec-capable device at your remote network site is capable of performing symmetric return (such as a Palo Alto Networks next-generation firewall), or if you did not select Allow inbound flows to other Remote Networks over the Prisma Access backbone, deselect Enable source NAT.
        If you allow inbound flows from other remote networks, you must enable source NAT.
      2. Add Applications to add the applications that you can retrieve using secure inbound access.
        You can configure up to 100 inbound applications for the 10 provisioned public IP addresses. Enter a unique Private IP address, Protocol, and Port combination for each application. It is acceptable to use duplicate private IP addresses and ports for two applications, as long as you select TCP for one application and UDP for another application.
        Provide the following values:
        • Specify the Name of the application.
        • Specify the Private IP address to use with this application.
        • Specify the Protocol to use with the application (TCP or UDP).
        • Specify the Port to use with the application.
        • Choose whether you want to dedicate a single public IP address to a single application; to do so, select Assign Dedicated IP.
    8. Save & Exit to save your changes and exit the wizard.
    9. Push Config to push your changes to Prisma Access.

    Panorama

    To configure secure inbound access for Prisma Access (Managed by Panorama) deployments that use site-based licensing, complete this task.
    1. Go to PanoramaCloud ServicesConfigurationRemote NetworksInbound Access and Add a remote network.
    2. Give the remote network a descriptive Site Name.
    3. Enter the site's City and Country.
      For more precise searches, add an address.
    4. Go to the Next screen.
    5. Select a site type and a primary location.
      1. Select a site type (License Type).
        The site type is based on bandwidth. Secure inbound access deployments support Medium (250 Mbps) and Large (1 Gbps) sites.
      2. Select a Primary Location.
        Secure inbound access deployments don't support secondary locations.
      3. Select the Number of Public IPs to use (10 (Large)).
      4. (Optional) If you have a resource that is in a remote network site that has inbound access enabled and you want users at non-inbound access sites to have access to that resource, you can Allow inbound flows to other Remote Networks over the Prisma Access backbone .
      5. (Optional) If you want to enable QoS for your site, select the QoS Profile you created at the start of this procedure and go to the Next step. To enable QoS for your site, select an existing QoS Profile. If you haven't created a QoS Profile, configure one before enabling QoS for the site. Select Next to continue.
    6. Define Tunnel & Circuit Settings.
      1. Select a Tunnel Mode of Active/Passive.
        You can configure remote networks that support secure inbound access in active/passive mode only.
      2. Select the Number of circuits to use (either 1 or 2).
        If you specify one circuit, you specify one tunnel for the circuit and Prisma Access creates a single primary tunnel. If you specify two circuits, specify two tunnels and Prisma Access creates a primary active tunnel and a primary passive tunnel. If the active tunnel goes down, Prisma Access fails over to the passive tunnel.
      3. Select the IPSec tunnels to use for your primary site by selecting either:
      4. Go to the Next step.
    7. Choose your Routing Settings and go to the Next step when complete.
      • Choose your Routing Settings.
        • Select the Routing Type (either Static or Dynamic).
          If you select Static routing, Add the IP subnets or IP addresses that you want to secure at the site.
          If you select Dynamic routing:
          • Enable dynamic routing.
          • (Optional) Select Summarize Mobile User Routes before advertising to reduce the number of mobile user IP subnet advertisements over BGP to your CPE by having Prisma Access summarize the subnets before it advertises them.
          • (Optional) Select Advertise Default Route to have Prisma Access originate a default route advertisement for the remote network using eBGP. Be sure that your network does not have another default route advertised by BGP, or you could introduce routing issues in your network.
          • (Optional) Select Don't Export Routes to prevent Prisma Access from forwarding routes into the HQ or data center.
          • Enter the Peer As (the autonomous system (AS) for your network).
            Use an RFC 6996-compliant BGP Private AS number.
          • Enter the Peer IP Address of the branch CPE's BGP neighbor interface.
            This is the remote IP address that Prisma Access uses to establish the BGP peering session. The BGP peer address is not necessarily the same as the BGP router ID.
          • (Optional) Enter the Local Address that Prisma Access uses as its Local IP address for BGP.
          • (Optional) Enter a Shared Secret password to authenticate BGP peer communications.
    8. Add the applications to provide secure inbound access.
      You can configure up to 100 inbound applications for each group of 10 provisioned public IP addresses. Enter a unique Private IP address, Protocol, and Port combination for each application. It is acceptable to use duplicate private IP addresses and ports for two applications, as long as you select TCP for one application and UDP for another application.
      Provide the following values:
      • Specify the name of the Application.
      • Specify the Private IP address to use with this application.
      • Specify the Protocol to use with the application (TCP or UDP).
      • Specify the Port to use with the application.
      • Choose whether you want to use a single, Dedicated IP address to a single application; to do so, select Yes.
    9. Create security policies to allow traffic from the inbound internet users.
      Because Prisma Access’ default security policy only allows untrust-to-untrust traffic, you need to configure security policies to allow untrust-to-trust traffic for your inbound access applications. Palo Alto Networks recommends that you limit the type of access you permit to inbound applications. The following examples provide access to SSH servers, web portals, and RDP servers.
      1. Select PoliciesSecurity and Add a policy.
        Be sure to create this policy under the Remote_Network_Device_Group device group.
      2. Select the Source traffic as Untrust.
      3. Create a policy to allow SSH server traffic by selecting the Destination Zone for destination traffic as Trust and specifying a Destination Address of SSH-server-public. This is an Address or Address Group object you created that has a list of all the public IP addresses that are used for SSH login.
      4. Select an Application of ssh.
      5. Select a Service/URL Category of application-default to allow or deny applications based only on their default ports as defined by Palo Alto Networks.
      6. In Actions, select Allow.
      7. Click OK to save the policy.
      8. Create a policy to allow web portal access by creating a policy in the previous steps but substituting the following settings in the Destination and Application tabs:
        • Select a Destination Address of an Address or Address Group of Web-Portal-Public, which contains all the public IP addresses of the web portal.
        • Select an Application of web-browsing.
      9. Create a security policy for RDP server access, using the same settings as you did for the other policies but creating an Address or Address Group object called RDP-Server-Public, which contains the public IP addresses for the RDP server, as the Destination Address and webrdp as the Application.
        When complete, you have three different policies to allow SSH server access, web portal access, and RDP server access.
    10. Commit and Push your changes.

    © 2026 Palo Alto Networks, Inc. All rights reserved.