>
    Strata Copilot
    Configure the Azure Virtual WAN with vION CloudBlade
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma SD-WAN
    3. Azure Virtual WAN with vION CloudBlade Integration
    4. Configure the Azure Virtual WAN with vION CloudBlade
    Download PDF
    Prisma SD-WAN

    Configure the Azure Virtual WAN with vION CloudBlade

    Table of Contents

    Configure the Azure Virtual WAN with vION CloudBlade

    Learn to configure the Azure Virtual WAN with vION CloudBlade.
    Where Can I Use This?What Do I Need?
    • Prisma SD-WAN (Managed by Strata Cloud Manager)
    • Prisma SD-WAN
    • Azure Virtual WAN with vION CloudBlade
    Before deploying the CloudBlade, it’s important to determine the kind of deployment that you are going to do. We support two deployment scenarios, Greenfield and Brownfield. Depending on the type of deployment you are doing it will determine which fields that need to be completed in the CloudBlade configuration.
    Brownfield Deployment
    • This is the most common deployment model.
    • This would be used when you already have the Azure Virtual WAN and associated vWAN Hub(s) in the region or regions that you wish to deploy the SD-WAN data centers.
    • The CloudBlade will deploy a Resource Group with a Transit VNET (per region), the ION devices will be deployed in the Resource Group and the VNET will be connected to the local regional Hub.
    Greenfield Deployment
    • The is a less common deployment model.
    • This would be used when you do not have a Virtual WAN configured in your Azure environment.
    • The CloudBlade will deploy a Virtual WAN and a vWAN Hub in the region or regions that you wish to deploy the SD-WAN data centers.
    • Once completed the CloudBlade will deploy a Resource Group with a Transit VNET (per region), the ION devices will be deployed in the Resource Group and the VNET will be connected to the local regional Hub.
    To configure the Azure virtual WAN Integration app in Prisma SD-WAN:
    1. In Strata Cloud Manager, go to ConfigurationPrisma SD-WANCloudBlades.
    2. Locate the Azure Virtual WAN with vIONand select Configure.
    3. In the Azure Virtual WAN with vION Integration page, enter the following information in the fields shown below, change where appropriate.
      Brownfield Configuration Example
      Greenfield Configuration Example
      • VERSION: Select the version of the Azure Virtual Network Integration CloudBlade.
      • ADMIN STATE: For Admin State, select/retain Enabled.
      • AZURE TENANT ID: Provide the Directory (tenant) ID generated in the previous section on Azure application registration. It is the ID of the Azure Active directory in which an application is created.
      • AZURE CLIENT ID: Provide the Application (client) ID generated in the previous section on Azure application registration. Client ID uniquely identifies an application in the Microsoft identity platform.
      • AZURE CLIENT SECRET: Provide the client secret generated under the Azure application registration. Client secret represents the authentication key string that is generated for a given app registration.
      • AZURE SUBSCRIPTION ID: Provide the subscription ID noted down from the previous section. Subscription ID is a GUID that uniquely identifies the subscription to use Azure services
      • TRANSIT VIRTUAL NETWORK CIDR: Provide comma-separated list of non-overlapping CIDRs for each region. The CIDR represents the private address space of the Virtual Network that hosts the Prisma SD-WAN vION instances and their associated resources in Azure. Prefix lengths of /16 up to /26 are supported. Format: <Azure Region Code>:<CIDR>. Example: westus:10.10.0.0/16.
        Enter information for TRANSIT VIRTUAL NETWORK CIDR if you have a brownfield or greenfield deployment.
      • Optional VIRTUAL HUB CIDR: Provide a comma-separated list of non-overlapping CIDRs for each virtual hub to be deployed. Prefix lengths between /1 and /24 are supported. This field is required only for new virtual hub deployments (Greenfield). Format: <Azure Region Code>:<CIDR> Example: westus:10.35.0.0/24.
        Enter information for VIRTUAL HUB CIDR only if you have a greenfield deployment.
      • Optional VIRTUAL WAN RESOURCE: Provide the name of the virtual WAN resource to be considered. This virtual WAN resource is used when deploying new vHUB(s) or referring to existing vHUB(s) identified in the Virtual Hub Resource(s) configuration. Format: <Resource Group Name>:<Virtual WAN Name>.
        Enter information for VIRTUAL WAN RESOURCE only if you have a brownfield deployment.
      • Optional VIRTUAL HUB RESOURCES: Provide a comma-separated list of virtual hub resource(s) in the respective region(s) with which peering is established. All virtual hubs need to reside within the same vWAN instance identified by the Virtual WAN Resource configuration. Format: <Virtual Hub Name>.
        Enter information for VIRTUAL HUB RESOURCES only if you have a brownfield deployment.
      Only virtual hubs in the same region can be associated with the transit vNET deployment in that region.
    4. Click Save and Install after the settings are configured.
      The deployment time for Greenfield deployments is around 20 to 25 minutes and the time taken for Brownfield deployments is around 10 to 15 minutes.

    © 2026 Palo Alto Networks, Inc. All rights reserved.