Prisma SD-WAN now supports Coffeeshop deployment to automatically route Prisma Access Mobile User and Explicit Proxy traffic directly to the internet at branch sites, eliminating the need to manually configure and maintain path policies as gateway IP addresses change. Prisma SD-WAN now automatically learns Mobile User and Explicit Proxy gateway IP addresses from the Prisma Access infrastructure and maintains read-only, dynamically updated prefix lists. For tenants with Remote Network High Performance enabled, Prisma SD-WAN creates a Default Path Coffeeshop Simple Stack Policy Set with two protected rules that route this traffic directly to the internet. The rules automatically synchronize backup and L3 failure paths with your default rule configuration.

You can activate this feature by attaching the auto-created policy set to your active path policy stack and enabling the rules. You can adjust rule priority and enable or disable the rules, but path and prefix configurations are read-only and managed automatically.