Cloud Provider Redundancy for Service Connections (Cloud Management)

Cloud provider redundancy is a Prisma Access 3.1 feature.
If you use service connections to provide mobile users access to internal resources and apps in an HQ or data center, you can ensure more resilient access to those resources by creating active and backup service connections in different cloud providers. You can specify these active and backup service connections in the same location or at different locations in different geographical regions, which allows you to access resources via service connections even when a cloud provider or region goes down.

Set It Up: Cloud Provider Redundancy

Here’s how to configure cloud provider redundancy for service connections.
Cloud provider redundancy is not supported with hot potato routing; if you’re using hot potato routing, you won’t see some of the fields that are required for setting up cloud provider redundancy in the cloud management interface.
  1. If you haven’t already, create at least two service connections that are enabling access to the same resource (like your HQ or data centers).
  2. Specify preferred and backup Prisma Access locations for a service connection.
    1. Go to
      Manage
      Service Setup
      Service Connections
      Service Connections
      Sites
      and add a new service connection or edit an existing service connection.
    2. Set preferred and backup Prisma Access locations for the service connection to use.
  3. Now, specify active and backup service connections for a site (your HQ or data center) to use.
    1. Go to
      Site Management
      and add or edit a site.
      Here, you’re not really adding a new site to Prisma Access; connecting a new site (like your HQ or data centers) to Prisma Access is part of setting up a service connection.
      What you’re doing here is grouping together service connections that are configured for the same site, so that you can designate active or backup connections for the site.
      For example, if you have two service connections that are enabling access to your HQ, SC1 and SC2, add a site and name it site1. Then, in the next step, you’ll specify for SC1 and SC2 to be backup or active service connections for that site.
    2. Specify which service connections should be active or backup connections for the site. There must be at least one service connection that is designated as active.
    3. Return to
      Sites
      and validate the active and backup service connections for the site.

How It Works: Cloud Provider Redundancy

If you use service connections to provide mobile users access to internal resources and apps in an HQ or data center, you can ensure more resilient access to those resources by creating active and backup service connections in different cloud providers. You can specify these active and backup service connections in the same location or at different locations in different geographical regions, which allows you to access resources via service connections even when a cloud provider or region goes down.
You can specify active and backup service connections for a
site
. Here’s the workflow to set this up:
  1. Create service connections (this is how you connect your internal resoureces—your HQ or data centers—to Prisma Access)
  2. Specify preferred and backup Prisma Access locations for a service connection
  3. Add a site, to group together service connections that are providing access to the same resource
  4. Specify active and backup service connections for the site
If a cloud provider or regional outage causes an active service connection in a site to go down, Prisma Access reroutes the traffic using these rules, which lets your mobile users continue to access the resources in that HQ or data center:
  • If there is a single active service connection in a site, Prisma Access selects the backup service connection in that site to route the traffic.
  • If there are multiple active service connections in a site, Prisma Access selects another of the active service connections to route the traffic.
To create a site that uses active and backup locations in the same country, select from a list of .
The following examples show the advantages of enabling this functionality:
  • Different Cloud Providers in the Same Geographical Region
    —If you are an organization (such as a bank) that requires your data to be accessed in a specific country, you can select a Preferred location from that country and an Alternate location from that same country. The following example shows an organization in the UK that onboards their service connections in the UK to follow data location regulations. In this case, the organization’s administrator onboards two service connections in UK, UK-Active in the UK location and UK-Backup in the UK PA-A location. The UK location is hosted by AWS and the UK PA-A location is hosted by GCP. The administrator then creates a site and designates UK-Active as the active location and UK-Backup as the backup location in that site.
    During normal operation, mobile users access internal resources at the HQ or data center using the UK-Active service connection.
    If a GCP outage affects the UK-Active service connection, Prisma Access fails over to the UK-Backup service connection, which is hosted on AWS. In this way, Prisma Access allows mobile users access to the resources at the data center or HQ, even in the event of a cloud provider outage. The following diagram shows the traffic flow.
  • Different Geographical Regions
    —If you want to ensure redundancy in case of a regional outage, you can specify two or more service connections in different compute locations as well as different cloud providers, which provide you with backup access in the event of an outage in a geographical region. In the following diagram, the administrator has onboarded service connections from locations in the United States (US-Active in the US Southwest location and US-Backup in the US Northwest PA-A location) and created a site making US-Active the active service connection in the site and US-Backup the backup.
    Since you have onboarded service connections that are in different compute locations as well as different cloud providers, you have configured a site that provides you with both geographical and cloud provider redundancy.
    If the US-Active location goes down (either because of a cloud provider or regional outage), the service connection fails over to the US-Backup location, which uses a different cloud provider and compute location from the US-Active service connection, as shown in the following diagram.
  • High-Bandwidth Connection Using Multiple Service Connections
    —If you require a higher-bandwidth connection to your internal resources, you can create a site with multiple active connections. The following diagram shows four sites being onboarded, with a mix of GCP and AWS cloud providers being used:
    • US-NW-GCP-Active, using the US Northwest (GCP) location
    • US-NW-AWS-Active, using the US Northwest PA-A (AWS) location
    • US-West-Active-GCP, using the US West (GCP) location
    • US-West-Backup-AWS, using the US West PA-A (AWS) location
    In the site, three of the service connections are designated as active service connections, with a fourth service connection being designated as backup. Designating three service connections as active effectively gives you three times the bandwidth to your internal resources when compared to a single service connection.
    If one of the active service connections goes down, the backup connection is not put into use; instead, Prisma Access diverts the traffic to the remaining active service connections that are up, as shown in the following diagram.
    If all the active service connections go down, then the backup service connection is put into use and made the active connection.
Use the following guidelines when configuring redundant cloud provider service connections:
  • You can add service connections using either locations in a site.
  • All service connections in a site must point to the same resource in the same HQ or data center location.
  • You must select at least one active service connection in a site; however, you can also have multiple active service connections in a single site. The following site configuration is valid:
    • US Central (active)
    • US Central PA-A (backup)
    • US East (active)
    • US East PA-A (backup)
  • If you have multiple active service connections in a site and an active service connection goes down, traffic is diverted to the other active service connection (that is, the backup service connection is not utilized as long as one of the active service connections is up).
  • Use the following guidelines for static and dynamic service connection routing:
    • If you use static routing for service connections, make sure that the subnets you specify for the service connections point to the same subnets.
      For example, if you have a site that uses 192.168.41.0/24, 192.168.44.0/24, and 192.168.47.0/24 as the subnets for the active service connections, make sure that you specify the same subnets for the backup service connections.
    • If you use dynamic (BGP) routing for service connections, make sure that all service connections advertise the same prefixes to the same data center or HQ.
      In addition, note that Prisma Access uses BGP Multi Exit Discriminator (MED) values to distinguish between active and backup service connections in a site.
  • You can add multiple sites in a single Prisma Access deployment, as shown in the following diagram.
  • You can still use a single, standalone service connection to access internal resources. You an also mix standalone service connections with active and backup service connections, as shown in the following diagram.
  • Service Connection multi-cloud redundancy is not supported when using Hot Potato routing for service connections.
  • Do not use CLI to enable regional redundancy.

Recommended For You