Overlay Prefix Filters for Branch Gateways

Where Can I Use This?	What Do I Need?
Prisma SD-WAN (Managed by Strata Cloud Manager)	Prisma SD-WAN Physical and virtual ION devices running software version 6.4.1 and higher for network optimization

Starting with release 6.8.1, Prisma SD-WAN supports overlay prefix filters for Branch Gateways. You can use overlay prefix filters to control which prefixes a Branch Gateway distributes over the secure fabric to other Branch Gateways or data centers, giving you precise control over routing behavior and preventing unwanted route propagation. You configure a filter using a prefix list on the source Branch Gateway site.

Overlay prefix filters for Branch Gateways are available for the following VPN combinations:

• Branch Gateway to Data Center (BGW-DC)
• Branch Gateway to Branch Gateway (BGW-BGW)

Migration and Default Behavior

Prisma SD-WAN does not create default prefix filters for existing or new Branch Gateway deployments.

• When you migrate from earlier releases, the system preserves your existing prefix distribution behavior.
• By default, all prefixes are allowed and distributed across the fabric.
• You can deny specific prefixes or configure a deny-all filter (0.0.0.0/0) to block everything, denying local and remote site prefixes.

Prefixes Eligible for Fabric Distribution

Prisma SD-WAN supports filtering for both IPv4 and IPv6 prefixes across Global and Custom VRFs. The following routing sources are eligible for fabric distribution:

• Global scope static routes
• Global scope interfaces and sub-interfaces
• Global scope LAN BGP learned prefixes
• Global scope LAN OSPF learned prefixes
• WAN path prefixes learned from other branches or branch gateways

Private WAN BGP learned prefixes and Standard VPN learned prefixes are not eligible for fabric distribution.

Prefix Filter Configuration Rules

When you configure prefix filters, keep these rules in mind:

• You must configure at least one rule to create a prefix filter profile.
• When you configure an allow or deny rule for a specific prefix, the action applies to that exact match and any subnets below it.
  For example, configuring a rule for 10.0.0.0/8 also applies to subnets within it.
• The system evaluates rules by order number (lowest first). If you configure a deny-all rule (0.0.0.0/0) with a lower order number than other rules, it blocks everything and makes subsequent rules irrelevant. To permit specific prefixes while blocking everything else, assign lower order numbers to the permit rules and a higher order number to the deny-all rule.
  For example, order 1 with 10.0.0.0/8 permit and order 2 with 0.0.0.0/0 deny permits all 10.x.x.x prefixes and blocks everything else.
• When you configure an allow rule for a specific prefix, the system implicitly denies all other prefixes in that VRF (applies to both IPv4 and IPv6).
• If you don't configure a specific VRF in the prefix filter, the system allows all prefixes for that VRF by default.
• For overlapping prefixes with different actions (for example, 10.0.0.0/8 allow and 10.0.0.0/16 deny), the order value determines which rule the system applies first.

Prefix filters are not bi-directional. To control prefix distribution in both directions, you must create prefix filter profiles separately on each site.

Branch Gateway to Branch Site Conversion

Converting a Branch Gateway to a branch site orphans existing prefix filters and requires you to delete BG-to-BG manual anynets. For detailed conversion prerequisites and behavior, see Add a Branch Gateway.

To create overlay prefix filters for Branch Gateways:

1. Select ConfigurationPrisma SD-WANBranch SitesOverlay Prefix Filters.
2. Select Add New Profile.
3. Enter a Prefix Filter Profile Name, and optionally enter a Description and Tags.
4. For VRF and Prefix Filter, choose the VRF from the dropdown (for example, Global, vrf1, vrf2).
5. Click + Add IP Prefix entry.
6. Fill out the following fields for each rule:

   • Order — Sequence prioritization order number.
   • IP Prefixes — Enter or choose IP prefixes (for example, 0.0.0.0/0, 10.10.10.0/24).
   • Permit/Deny — Choose from the dropdown.
7. Click Submit.