Prisma Access
Mobile User and Remote Network Routing to Service Connections
Table of Contents
Mobile User and Remote Network Routing to Service Connections
Learn how mobile user and remote network routing works
from Prisma Access service connections.
It is useful to understand how Prisma Access routes
traffic between mobile users, remote networks, and service connections,
because the routing used by mobile user traffic and remote network
traffic between service connections is different.
Mobile User-service connection routing
—The mobile user connection
forms an IPSec tunnel with the nearest service connection. Prisma
Access uses iBGP for internal routing and eBGP to peer with the
customer premises equipment at the data center. The following diagram
shows mobile users in Regions 1 and 2 being routed to the respective
service connections in that region. Mobile users in Region 1 are
accessing applications A
and B
located at Data Center
1. If your organization’s network uses BGP routing for their service
connections and a service connection experiences an ISP failure
at Data Center 1, Prisma Access detects the failure and routes the
traffic for applications A
and B
to Data Center 2
after BGP convergence, providing redundancy to your network’s data
centers.
Prisma Access uses the following timing with BGP when it
detects a failure: If you configure BGP routing and have enabled
tunnel monitoring, the shortest default hold time to determine that
a security parameter index (SPI) is failing is the tunnel monitor,
which removes all routes to a peer when it detects a tunnel failure
for 15 consecutive seconds. In this way, the tunnel monitor determines the
behavior of the BGP routes. If you do not configure tunnel monitoring,
the hold timer determines the amount of time that the tunnel is
down before removing the route. Prisma Access uses the default BGP
HoldTime value of 90 seconds as defined by RFC 4271, which is the
maximum wait time before Prisma Access removes a route for an inactive
SPI. If the peer BGP device has a shorter configured hold time,
the BGP hold timer uses the lower value. When the secondary tunnel
is successfully installed, the secondary route takes precedence
until the primary tunnel comes back up. If the primary and secondary
are both up, the primary route takes priority.
Remote Network-service connection routing
—Prisma Access creates
a full mesh network with other remote networks and service connections.
As with mobile users, Prisma Access uses iBGP for its internal routing
and eBGP to peer with customer premises equipment to exchange routes.
If a user in Branch 1 is accessing application A
from Data
Center 1 in your organization’s data center and the link between
Branch 1 and Data Center 1 goes down, Prisma Access routes the traffic
for application A
to Data Center 2 after BGP convergence.