Traffic Steering

Traffic Steering Requirements

Traffic Steering Examples

Default Route Example

The following example shows a sample Prisma Access deployment the following components:

• Two Prisma Access mobile user locations; one in the United States (US) and one in Europe (EU).
• Two Prisma Access service connections; one in the US and one in the EU, with both data centers sending default routes to the service connections (Accept Default Route over Service Connections is enabled).
• Two data centers; one in the US and one in the EU.
  Each data center has a 3rd-party security stack; for this reason, you want all internet-bound traffic to go through the data center before egressing to the internet.

When a mobile user sends data center traffic, Prisma Access checks its routing tables, determines the closest service connection, and forwards the traffic to that service connection. In the following example, Prisma Access sends data center traffic from the mobile users in the US to Service Connection and traffic from the mobile users in the EU to Service Connection 2.

Use non-dedicated service connections with default routes; dedicated service connections do not participate in BGP routing, so they cannot receive BGP advertisements from the HQ or data center.

To enable default routes, select Accept Default Route over Service Connections when you configure traffic steering settings. After you configure this setting and commit and push your changes, Prisma Access sends internet-bound traffic over the service connections.

Default Routes with Traffic Steering Direct to Internet Example

The following example shows you using more granular control for external SaaS application-bound traffic. In this case, you want to send Office 365 traffic to egress to the internet directly from the mobile user location, instead of sending it to the data center for further processing. Use traffic steering along with default routes for this configuration.

To allow Prisma Access to route Office 365 traffic directly to the internet, perform the following actions:

• Create an EDL (ObjectExternal Dynamic Lists) with IP addresses that match the Office 365 addresses.
• Create a Custom URL category (ObjectsCustom ObjectsURL Category) with URLs that match Office 365 URL.
• create create traffic forwarding rules and specify the EDL and URL category you created as destination match criteria with an Action of Forward to the internet.

This configuration sends Office 365 traffic directly to the internet, while other internet-bound traffic is sent to the data center for further processing before egressing to the internet.

Default Routes with Traffic Steering and Dedicated Service Connection Example

In this example, in addition to the previous configuration, you have a third-party internet security service, and you want to send traffic from box.com to be processed by the security service before egressing to the internet. You do not want to send any other internet-bound traffic to the security service; for this reason, you create a dedicated service connection for the box.com traffic. After your configuration is complete, Prisma Access sends *.box.com destination traffic to the stack.

To enable this deployment, you perform the following actions in the Traffic Steering tab:

• Create a Target Service Connection group that assigns one or more service connections to the target and select Dedicated for Traffic Steering Only, which makes the target service connection or connections dedicated.
  If you create a target with more than one service connection, Prisma Access chooses the best service connection to forward the internet-bound traffic.

• Create a traffic steering rule that forwards traffic to the URL. The following screenshot shows the traffic destination being assigned a custom URL category that contains the URL *.box.com.

• Create an Action in the traffic steering rule of Forward to the target and specify the target group name you created (dedicated in this case).

Traffic Steering Rule Guidelines

Traffic steering can process a wide variety of possible configurations; however, it is important to understand how Prisma Access processes rules, so you can create rules are easy to maintain and manage. To help you create the rules that work best for your deployment, follow these guidelines:

• Prisma Access evaluates rules in the order that you create them (from top to bottom). Specify more specific rules at the top and more general rules at the bottom.
• Palo Alto Networks recommends that you create multiple rules with fewer matching criteria, instead of creating fewer rules with multiple types of criteria. Creating simpler rules both speeds up rule creation and makes it easier to modify a rule.
• Since you cannot move a rule up or down in a list after you create it, carefully plan your rule order before you create the rules.
• Rules that specify Any source address and User, Any source destination and URL Category, and Any service are not supported. Use more specific rules; for example, specify a rule with Any source or destination traffic and a service of service-http and service-https.
• If you are going to specify rules for users in the Source User field, make sure that Prisma Access can distinguish between users if the same username is shared between users who authenticate locally and users who authenticate using LDAP by authenticating LDAP users in the format of domain/username and authenticating local users in the format of username (without the domain name).
• If you have configured an on-premises next-generation firewall as a master device, you can auto-populate user and group information for mobile user device groups in traffic steering and security policy rules by selecting PanoramaCloud ServicesConfigurationMobile Users, clicking the gear icon to edit the Settings, and selecting the Master Device in the Device Group area. While this populates the master device in every device group, it only populates the user and group information for mobile users in security policy rules.
• If an EDL (type IP List) is used in a Traffic Steering Rule, and the EDL source URL of the EDL is updated to a URL that is not accessible, Prisma Access may continue to use the cached IP list from the previous URL.
• Prisma Access bypasses Traffic Steering for rules with a service type of HTTP or HTTPS if you use an application override policy for TCP ports 80 and 443.
  In addition, traffic steering does not work for URLs from URL categories referenced in the traffic steering rule if you have configured an application override policy for TCP ports 80 or 443.
• You can specify destination IP addresses and URL categories in the same rule. If you do, Prisma Access uses a logical OR to process the destination criteria in the rule, but processes the URLs and URL category traffic based on TCP ports 80 and 8080 for HTTP and TCP port 443 for HTTPS.
  For a rule with IP addresses and URL categories, traffic matches the rule if either the IP address or the URL category matches, but processes the URL category traffic based on ports 80, 443, and 8080 only. Palo Alto Networks does not recommend creating a rule of this type; instead, create simpler rules.

For example, you want to enforce the following rules for your network traffic:

• You have an internal HTTP server with an IP address of 10.1.1.1 in the data center, and you want to direct internal HTTP and HTTPS traffic to this server. The IP address of the server is 10.1.1.1.
  Traffic to this server should not go to the internet and should be processed internally; therefore, choose a non-dedicated target for this traffic, because this type of target processes both internal and internet-bound traffic.
• You want office365.com traffic to be routed directly to the internet.
• You want traffic from *.example.com or any traffic defined in a custom URL category of custom-social-networking to be routed to a dedicated connection.
• You want any other HTTP and HTTPS traffic to use the same non-dedicated service connection target as that used for the internal HTTP server.

For this example, create the rules from the most specific to the least specific, as shown in the following screenshot. Do not add the rule that allows all HTTP and HTTPS traffic first, or Prisma Access would direct all HTTP and HTTPS traffic to the non-dedicated connection without evaluating any of the other rules.

Zone Mapping and Security Policies for Dedicated Connections

1. Select NetworkZones.
2. Select the correct Template from the drop-down list (either Mobile_User_Template for mobile users or Remote_Network_Template for remote networks).
   If you have a mobile user and a remote network deployment, you need to perform these steps twice; once in the Mobile_User_Template and once in the Remote_Network_Template.
3. Add two zones for your trusted and untrusted zones.
   This example creates two zones called Trust and Untrust.

4. Create default policies for the zones you created.
   1. Select PoliciesSecurityPost Rules.
   2. Select the correct Device Group from the drop-down list (either Mobile_User_Device_Group for remote networks or Remote_Network_Device_Group for mobile users).
      If you have a mobile user and remote network deployment, you need to perform these steps twice; once in the Mobile_User_Device_Group and once in the Remote_Network_Device_Group.
   3. Add a default policy to use for Trust zone-to-Trust zone traffic.
      This policy allows Any traffic to pass for all Source, User, Destination, Application, and Service/URL Category traffic.

   4. Add a default policy to use for Trust zone-to-Untrust zone traffic, using the same parameters you used for the Trust-to-Trust policy.
      When complete, you have two security policies, one for Trust-to-Trust traffic and one for Trust-to-Untrust traffic.

5. Define Zone Mapping for the remote networks, mobile users, or both, as required for your deployment.
   1. Set the zone mapping for the remote networks, mobile users, or both.
      • For mobile users, select PanoramaCloud ServicesConfigurationMobile Users.
      • For remote networks, select PanoramaCloud ServicesConfigurationRemote Networks.
   2. Click the gear icon next to Zone Mapping to edit the settings.

   3. Set the Zone Mapping for your deployment, moving the zone for trusted traffic to the Trusted Zones and the zone for untrusted traffic to the Untrusted Zones; then, click OK.

Configure Traffic Steering

1. Onboard your service connections, mobile users and remote networks, as applicable to your deployment.
2. Select PanoramaCloud ServicesConfigurationTraffic Steering.
3. (Optional, mobile user deployments only) Allow Prisma Access to accept and install the default route advertised over one or more service connections from the CPE by clicking the gear icon to open the Settings and selecting Accept Default Route over Service Connections.
   Default routes have specific guidelines that you must follow when using them; for example, default routes are supported for mobile user deployments only and have no effect on remote network deployments. Be sure to review these guidelines before implementing default routes with traffic steering.

4. (Optional) Create a target group and assign a service connection to it.
   1. In the Target Service Connections for Traffic Steering area, Add a group and give it a Group Name.
   2. Add a Target for the traffic, specifying the Service Connection to use with the target; then, click OK.
      Palo Alto Networks does not recommend using multiple service connections (whether dedicated or non-dedicated) in a target service connection group that is referenced in a traffic steering rule. In addition, a given service connection can only exist in one target and you cannot add a single service connection to two different targets.
   3. Choose whether to make the service connections associated with this target a dedicated service connection.
      • You can use a dedicated service connection to steer traffic to a third-party security stack or cloud that is not on your premises and does not need to participate in routing. To set a service connection to be used as a dedicated service connection, select Dedicated for Traffic Steering Only.
        Dedicated service connections change their zones; see Traffic Steering for details.
      • Deselect Dedicated for Traffic Steering Only if you will send both normal service connection-related and traffic steering traffic through the service connection; with this choice, the zone for the service connection remains as Trust.
   4. Choose whether to enable or disable source NAT.
      To disable source NAT for Dedicated service connections, select Disable Source NAT for Dedicated SC. Source NAT is enabled by default (the check box is deselected).

      If you disable source NAT, Prisma Access uses your organization’s source IP addresses for the dedicated service connection. If you enable source NAT, Prisma Access uses the EBGP Router address of the service connection (PanoramaCloud ServicesStatusNetwork DetailsService ConnectionEBGP Router) as the source IP address, even after the traffic egresses from the dedicated service connection.

5. Create rules for the target you created and apply them to the target.
   1. In the Traffic Steering Rules area, Add a traffic steering rule.
   2. in the General tab, Name the traffic steering rule.
   3. In the Source tab, specify rules for source traffic.
      • In the Source Address field, specify one or more of the following objects, or select Any to have traffic from any source go to this target:
        • An IP address
        • An address object that you created in Panorama (ObjectsAddresses)
        • A Dynamic Address Group (DAG)
        • An External Dynamic List (EDL) using IP addresses or URLs
      • In the Source User field, specify rules for source user traffic. You can specify the following user information:
        • Users
          Enter users in either the domain/user or the user@domain format.
        • User groups
          Use full distinguished names (DNs) when entering user groups.
        • Users configured on Panorama (DeviceLocal User DatabaseUsers)
        • User groups configured on Panorama (DeviceLocal User DatabaseUser Groups)

      If you use address objects, DAGs, EDLs, users, or user groups, specify them as Shared to share them with all device groups in Prisma Access. In addition, do not enter 0.0.0.0/0 in address objects, DAGs, or EDLs; instead, enter 0.0.0.0/0 directly in the rule.

      Prisma Access automatically populates users from the mobile users device group only.
   4. In the Destination tab, specify the following values:
      • In the Destination area, specify one of the following criteria, or select Any to have traffic processed by the rules in the URL Category field:
        • An IP address or prefix
        • An address object that you created in Panorama (ObjectsAddresses)
        • A Dynamic Address Group (DAG)
        • An IP address-based External Dynamic List (EDL)
        Do not enter 0.0.0.0/0 in address objects, DAGs, or EDLs; instead, enter 0.0.0.0/0 directly in the rule.
        Leave Any selected to pass all traffic to be processed by the rules in the URL Category area. If you specify rules in the Destination, and URL Category areas, Prisma Access processes the rules in the Destination category first.
      • In the URL Category field, enter a custom URL category (ObjectsCustom ObjectsURL Category) When you create a custom URL category, enter URLs in all lower case. Traffic steering supports custom URL and predefined URL categories.
        You can use wildcards with the URLs in URL categories. The following wildcard formats are supported:
        • *.example.com
        • *.fqdn.example.com
        The following formats are not supported:
        • *
        • *.*
        • *example.com
        • example.com/ (trailing slashes in URLs are not supported in URL categories that are used with Traffic Steering)
        • example.com/path (only domain names are supported)
        • *fqdn.example.com
        • fqdn.example.*
        URLs in custom URL categories use the same URL pattern matching as that used by next-generation firewalls.

      Use the following guidelines when configuring destination options:

      • If you specify a URL category, Prisma Access only matches HTTP and HTTPS traffic, even when service is set to Any.
      • Do not create a custom URL category with a type of Category Match.
      • Do not create a custom URL category with the name Custom_URL_Category_TFR because, for deployments that are migrated from Prisma Access 1.7 to 2.0, URLs entered in the URL area from 1.7 are moved to a custom URL category named Custom_URL_Category_TFRnumber, where number is a number appended to the custom URL category.

   5. In the Service tab, specify a service type.
      Specify service-http to forward HTTP traffic and specify service-https to specify HTTPS traffic. Select Any to forward traffic of any service type.
   6. In the Action tab, select the Target Group Name that you want to apply to the traffic steering rule.
   7. Forward traffic to the specified service connection target, or send the traffic directly to the internet without going through the service connection.
      • To have Prisma Access forward traffic to a service connection target, select Forward to the target; then select the Target Group Name.
      • To have Prisma Access forward traffic directly to the internet without first sending it to a service connection, select Forward to the internet.

   8. Click OK to save your changes.
6. Optional Specify additional traffic steering rules.
   Prisma Access processes multiple rules in the order that you create them (from top to bottom).
7. Commit and push your changes to make them active in Prisma Access.
   1. Select CommitCommit and Push and Edit Selections in the Push Scope.
   2. Select Prisma Access, then select Service Setup, Remote Networks, and Mobile Users.

   3. Click OK to save your changes to the Push Scope.
   4. Commit and Push your changes.