Panorama

1. Create and configure a hypervisor resource profile to use with your SASE Private location.

   You use this profile with the ESXi instance you created to create an environment for SASE Private Location.

   Optionally, you can create this profile during SASE Private Location setup instead of creating it now.
2. From Panorama, go to PanoramaCloud ServicesConfigurationService SetupPrisma Access Private Locations and click the gear to edit the settings.

3. From the Private Locations tab, Add a new private location.

4. Enter the location details.

   • Enter a unique Name for the private location.
     Don’t use spaces or dashes. Make sure that each SASE Private Location has a unique name, even across multiple tenants. You can’t change the name after you perform a Commit and Push operation.
   • (Optional) Enter a Description for this location.
   • Enter the Country, State, and City, and, optionally, the Zip/Postal Code closest to the area where this location will be deployed.

   Prisma Access populates the Latitude and Longitude based on the city or other geographic information you enter.

   When complete, go to the Next section.

5. Enable service capabilities for your SASE Private Location by entering the estimated number of users to secure with SASE Private Location (for Mobile Users) and the bandwidth to allocate (for Local Inspection Nodes).

   For Mobile Users, the number depends on the number of mobile users in your Prisma Access license. For example, if you have a mobile user license of 2,000 units, enter a maximum of 2,000 estimated users. If you have already set up multiple SASE Private Locations, the total number of mobile users must be distributed across the regions and you cannot allocate the maximum number of mobile users in each region.

   For local inspection nodes, enter the estimated bandwidth to allocate for the node. This number cannot exceed the number of units you have in your Prisma Access license.

   When complete, go to the Next section.

6. (Local Inspection Node Deployments Only) Configure settings for Local Inspection Nodes.

   1. Specify the Hypervisor Resource Profile to use, or Create Profile and create a hypervisor resource profile based on your VMware ESXi environment.
   2. Specify the DNS Server assignment (either DHCP or Static).

      If you want to use a static DNS server, enter the primary server and the secondary server.
   3. Enter the Load Balancer Configuration.

      Use the same IP addresses that you configured for the ESXi environment.

      • Enter the two IP addresses used for the Virtual Public IP Address.
      • Enter the Management IP Assignment (either DHCP or Static). If you use a static Management IP address, enter the Primary IP, Secondary IP, Netmask, and Gateway for the management IP address configuration.

   4. Enter the VM instance data plane settings.

      You need to configure 2 VMs, one for Trust and one for Untrust. Use the Trust settings for internal traffic and the Untrust settings for internet traffic.

      • Enter the Management IP Assignment (either DHCP or Static). If you use a static Management IP address, enter the Primary IP, Secondary IP, Netmask, and Gateway for the management IP configuration.
      • Enter the Data Plane IP address information, including the Primary IP, Secondary IP, Netmask, and Gateway.

   5. Go to the Next step when complete.
7. Configure settings for mobile users.

   1. Specify the Hypervisor Resource Profile to use, or Create Profile and create a hypervisor resource profile based on your VMware ESXi environment.

   2. Specify the DNS Server assignment (either DHCP or Static).

      If you want to use a static DNS server, enter the primary Server and the secondary server.
   3. Enter the Load Balancer Configuration.

      Use the same IP addresses that you configured for the ESXi environment.

      • Enter the two IP addresses used for the Virtual Public IP Address.
      • Enter the Management IP Assignment (either DHCP or Static).
        If you use a static Management IP address, enter the Primary IP, Secondary IP, Netmask, and Gateway for the management IP address configuration.
        Use the same IP addresses that you configured for the ESXi environment.
      • Enter the Load Balancer Data Plane & Management IP Address, including the Primary IP, Secondary IP, Netmask, and Gateway.

   4. Enter the VM instance data plane settings.

      The number of instances depend on the number of mobile users you estimate to use. For deployments of fewer then 4,000 mobile users, Prisma Access allocates two VM instances; for deployments of 4,000 or more, Prisma Access allocates an additional VM for a total of three.

      • Enter the Management IP Assignment (either DHCP or Static).
        SASE Private Location uses these IP addresses for management only. If you use a static Management IP address, enter the Primary IP, Secondary IP, Netmask, and Gateway for the management IP configuration.
      • Enter the Data Plane IP address information, including the Primary IP, Secondary IP, Netmask, and Gateway.

   5. Go to the Next step when complete.
8. Set up a Bastion Agent by specifying a Hypervisor Resource Profile.

   Prisma Access uses the bastion host (bastion agent) for remote management, maintenance, and monitoring.

   Palo Alto Networks recommends that you specify the same VM instance that you specified for the hypervisor resource profile.

   Go to the Next step when complete.
9. Review your configuration.

   If you need to make any changes to your configuration, go to the Previous selection screens and edit your choices; otherwise, Save and Next to save your changes and go to the next screen.

10. Perform a Commit and Push operation in Panorama.

    You must exit from the wizard to perform the commit and push operation.

    1. Cancel the configuration process to exit and wizard.

       Canceling the wizard does not lose your configuration changes.

    2. Select CommitCommit and Push.

    3. Commit and Push your configuration changes.

    4. Wait for the commit and push operation to complete.
11. (Mobile Users Deployments Only) Set up your mobile users deployment in Prisma Access.

    1. Select PanoramaCloud ServicesConfigurationMobile Users—GlobalProtect.
    2. In the Onboarding section, select the Hostname in the hostname area if you've already configured Prisma Access mobile users, or select Configure in the hostname area to configure it for the first time.

    3. In the Locations tab, select a Prisma Access region.

       Select the region where you deployed the SASE Private Location.

    4. Select the SASE Private Location you created and Save your changes.

       Switch from the Map view to a List view to find the location you created; then select the location.

       Click Yes if prompted to add the location.
12. (Local Inspection Node Deployments Only) Set up your Local Inspection Node settings.

    1. Go to PanoramaCloud ServicesConfigurationRemote Networks and select the Local Inspection Node tab.

    2. Add a Local Inspection Node, select, the SASE Private Location you created, and go to the Next step.

    3. Add a static route.

       Only static routes are supported.

       • Provide a unique Name for the route.
       • Enter a Destination IP address and subnet the local inspection node can reach.
       • Select a Next Hop type of IP Address.
       • Enter a Next Hop IP Address, which is the IP address of the device at the next hop toward the Destination network. A next hop of 0.0.0.0 indicates the default route.
       • Enter a Metrics.
         This field is the metric for the route. When a routing protocol has more than one route to the same destination network, it prefers the route with the lowest metric value. Each routing protocol uses a different type of metric; for example, BGP uses the Multi Exit Discriminator (MED) Attribute. Prisma Access considers the metric when making routing decisions; for example, given the same route, Prisma Access prefers a static route with a lower metric over a BGP route with a higher metric.
       • Enter an Admin dist.
         The administrative distance number is used by routers to find out which route is better. A lower number is preferred over a higher number.

13. Perform another Commit and Push operation by selecting CommitCommit and Push and Commit and Push your changes.
14. (Optional) Check the status of your SASE Private Location deployment by checking your deployment in the Private Locations tag under PanoramaCloud ServicesConfigurationService SetupPrisma Access Private Locations.

    The newly-deployed region should show a Prisma Access Onboarding Status of Complete and an On-Prem Deployment Status of Pending. The Pending state indicates that you have not yet deployed the SASE Private Location to your on-premises environment.

15. Deploy the SASE Private Location to your on-premises environment.

    1. Return to PanoramaCloud ServicesConfigurationService SetupPrisma Access Private Locations, select the location you were configuring, go to the Onboarding to Prisma Access step, and click Save and Next.

    2. In the Deploy to your On-Prem Environment step, Generate Authentication Key and copy its contents.

       You use this key in the Terraform template. This authentication key is valid for one hour.

    3. Download Terraform Template and save it to your local device.

       The Terraform .tf template downloads to your local system. You fill out the template with information about your system.

    4. Open the Terraform file in a text editing program and edit the following parameters:

       • Replace <vcenter_hostname> with your ESXi hostname.
       • Replace <vcenter_username> with the ESXi username.
       • Replace <vcenter_password> with the ESXi password.
       • Replace <prismasase_deployment_token> with the authentication key you just downloaded.
    5. Edit the template for your environment.

       • Replace <vcenter_hostname> with the ESXi vCenter hostname.
       • Replace <vcenter_usernasme> with the ESXi vCenter username.
       • Replace <vcenter_password> with the ESXi vCenter password.
       • Replace <prismasase_deployment_token> with the authentication key you generated and copied in an earlier step.
    6. Initialize the Terraform environment by entering the terraform-init command to initialize Terraform and download the required provider:
    7. Generate a plan to review the resources that will be created by entering the terraform plan command.
    8. Apply the configuration to deploy the SASE Private Location components by entering the terraform apply command.
    9. Confirm the deployment when prompted.

       After successful deployment, the SASE Private Location components are provisioned in your VMware ESXi environment. The components will register with the Prisma Access cloud service and become available for configuration through the Prisma Access management interface.

       You can verify the deployment status in the Prisma Access management interface, where the newly deployed SASE Private Location will appear as an available region for your tenant.
16. Verify that the SASE Private Location deployment was successfully completed.

    1. Go to ConfigurationNGFW and Prisma Access, select the Prisma Access configuration scope, and then select Prisma Access Setup
    2. Check the Prisma Access Private Locations

       • On-Prem Onboarding Status—Shows the progress of the SASE Private Location onboarding. Onboarding is complete when this field displays Complete.
       • On-Prem Deployment Status—Shows the progress of the SASE Private Location deployment. Deployment is complete when this field displays Complete.

17. Configure security policy rules specific to your SASE Private Location using tags.