Prisma Access
Enable ZTNA Connector
Table of Contents
Expand All
|
Collapse All
Prisma Access Docs
-
- Prisma Access China
- 4.0 & Later
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
-
-
-
- 5.0 Preferred and Innovation
- 4.2 Preferred
- 4.1 Preferred
- 4.0 Preferred
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
Enable ZTNA Connector
Learn how to configure a ZTNA Connector in Prisma Access.
Where Can I Use
This? | What Do I Need? |
---|---|
|
|
Before you can set up ZTNA Connector, you must enable it within Prisma Access. Before
you enable ZTNA Connector, do the following:
- Review the ZTNA Connector Requirements and Guidelines.
- Identify your Application IP and Connector IP address blocks. You must reserve a separate address pool to reserve for use within Prisma Access internally to route traffic to the connectors and private applications you’ll be onboarding. Prisma Access resolves the FQDNs of the applications you onboard to ZTNA Connector to the IP addresses in the Application IP address block. Similarly, Prisma Access uses the Connector IP address block to route traffic from the remote network or mobile user to the appropriate ZTNA Connector.You should reserve at least a /16 subnet for the address pool. Use RFC 1918 or RFC 6598 addresses. You can specify an RFC 1918 address pool during ZTNA Connector setup instead of RFC 6598; however, you cannot change the address pool type back to RFC 6598 after you specify RFC 1918.
Cloud Management
Learn how to configure a ZTNA Connector in Prisma Access.
Use the following workflow to enable ZTNA Connector in Cloud Managed Prisma
Access.
- Configure the IP address blocks that Prisma Access will use internally to route traffic to the ZTNA Connector and the private apps you onboard.You must define separate IP address blocks for your connectors and your applications and the blocks cannot overlap with each other, with the Prisma Access infrastructure subnet, or with you GlobalProtect IP address pool.
- Selectand Edit theSettingsPrisma Access SetupSharedInfrastructure Settings.If you're using Strata Cloud Manager, go to.WorkflowsPrisma Access SetupPrisma AccessInfrastructure Settings
- AddZTNA Connectors Application IP Blocks.You can add a single Application IP Block, or multiple blocks depending on your deployment. For example, enter 10.64.10.0/24 and 10.64.11.0/24. You can alsoAdvertise Application IP blocks to Remote Networksto provide remote network access.Use RFC 1918 or RFC 6598 addresses. You can specify an RFC 1918 address pool during ZTNA Connector setup instead of RFC 6598; however, you cannot change the address pool type back to RFC 6598 after you specify RFC 1918.
- AddZTNA Connectors Connector IP Blocksthat Prisma Access will use internally to route traffic between mobile users, remote networks and the connector VMs in your data centers.You can add a single Connector IP Block, or multiple blocks depending on your deployment. For example, enter 100.65.10.0/24 and 100.65.11.0/24.
- ClickSaveto save the IP address block configuration and thenCommitand push the configuration.
- Launch ZTNA Connector from the Prisma SASE Platform.
- Log in toPrisma SASE Platform.
- Select.SettingsZTNA ConnectorIf you're using Strata Cloud Manager, go to.WorkflowsZTNA Connector
- If you haven't done so already,Enable ZTNA Connector.
- Prisma Access begins setting up the infrastructure for the ZTNA Connector. This may take a few minutes.
- When onboarding finishes, the ZTNA Connector Overview displays.
Panorama
Learn how to configure a ZTNA Connector in Panorama-managed Prisma
Access.
Use the following workflow to enable ZTNA Connector in Panorama Managed Prisma
Access.
- Configure the IP address blocks that Prisma Access will use internally to route traffic to the ZTNA Connector and the private apps you onboard.
- Selectand Edit thePanoramaCloud ServicesConfigurationService SetupSettings.
- On theZTNA ConnectortabAddanApplication IP Block.You can add a single Application IP Block, or multiple blocks depending on your deployment. For example, if 10.64.10.0/24 and 10.64.11.0/24. You can alsoEnable Advertise Application IP Block to Remote Networks.Use RFC 1918 or RFC 6598 addresses. You can specify an RFC 1918 address pool during ZTNA Connector setup instead of RFC 6598; however, you cannot change the address pool type back to RFC 6598 after you specify RFC 1918.
- Set theConnector IP Blocksthat Prisma Access will use internally to route traffic between mobile users, remote networks and the connector VMs in your data centers.You can add a single Connector IP Block, or multiple blocks depending on your deployment. For example, enter 10.65.10.0/24 and 10.65.11.0/24.
- ClickOKto save the IP address block configuration and thenCommitand push the configuration.
- Launch ZTNA Connector from the Cloud Services Plugin on Panorama.
- Select.PanoramaCloud ServicesZTNA Connector
- Click thePrisma Access Appto launch ZTNA Connector in the Prisma Access app on the hub.
- From the Prisma Access app, select.SettingsZTNA Connector
- If you haven't already done so,Enable ZTNA Connector.
- Prisma Access begins setting up the infrastructure for the ZTNA Connector. This may take a few minutes.
- When onboarding finishes, the ZTNA Connector Overview displays.