1. Home
    2. Prisma
    3. Prisma Access
    4. Prisma Access (Cloud Management)
    5. Third-Party SD-WAN Integration
    6. Silver Peak SD-WAN Solution Guide
    7. Configure the Silver Peak Remote Network

    Configure the Silver Peak Remote Network

    Configure the remote network between the Silver Peak SD-WAN and Prisma Access by completing the steps in the following workflows:

    Configure the Remote Network Tunnel

    Use this workflow to configure Silver Peak EdgeConnect with Prisma Access.
    Silver Peak recommends that you configure two tunnels in an active-backup configuration between Silver Peak EdgeConnect and Prisma Access, because there are some restrictions for accessing resources at other network locations when you configure the tunnels in an active-active configuration because of the overlapping subnets.
    Before you start this workflow, determine your remote tunnel capacity. Silver Peak bases the tunnel capacity on licensing and the capacity of the device model. For example, the base Silver Peak license supports up to 200 Mbps WAN uplink, and the EC-XS supports 200 Mbps. Prisma Access bases a location’s bandwidth on the bandwidth you specify for its compute location.
      • Choose a
        Prisma Access Location
         that is close to the remote network location that you want to onboard.
      • When creating the IPSec tunnel, use a
        Branch Device Type
         of
        SilverPeak
        .
    2. Select
      IPSec Advanced Options
       and select an IPSec Crypto Profile of
      SilverPeak-IPSec-Crypto-Default
      .
    3. Select
      IKE Advanced Options
       and select an IKEv1 Crypto Profile of
      SilverPeak-IKE-Crypto-Default
      .
    4. Set up routing for the remote network.
      Set Up
       Routing and
      Add
       the IP subnets for Static Routing.
    5. Push your configuration changes.
      1. Return to
        Manage
        Service Setup
        Remote Networks
         and select
        Push Config
        Push
        .
      2. Select
        Remote Networks
        .
      3. Push
         your changes.
    6. Make a note of the
      Service IP
       address of the Prisma Access side of the tunnel. To find this address in Cloud Managed Prisma Access, select
      Manage
      Service Setup
      Remote Networks
      , click the
      Remote Networks
      , and look for the
      Service IP
       field corresponding to the remote network configuration you created.
    7. From the Silver Peak orchestrator, create a tunnel configuration.
      1. Select
        Configuration
        .
      2. Select
        Tunnels
        Passthrough
      3. Select
        Add Tunnel
        .
      4. Select a
        Name
        ,
        Local IP
        ,
        Remote IP
        , and
        Mode
        .
      5. In the
        Advanced Options
         area, enter the IKE and IPSec parameters.
        The parameters must be the same as the parameters that you specified on Prisma Access. Silver Peak recommends the following IKE and IPSec encryption settings:
        • IKE encryption settings:
          • Encryption
            —AES-256-CBC
          • Authentication
            —SHA512
          • IKE Lifetime
            —8 hours
          • Dead Peer Detection
            —
            Delay time:
             300 seconds
            Retry:
             3
          • IKE Identifier
             —IP address (leave blank - public IP is auto-detected)
          • DH
            —Group 14
          • Mode
            —Aggressive
        • IPSec encryption settings:
          • Encryption
            —AES-25-CBC
          • Authentication
            —SHA512
          • Lifetime
            —60 minutes
          • PFS
            —DH - Group 14
    8. Create two tunnels to Prisma Access: one Active and the other Backup.
      The following example creates two tunnels named
      GlobalProtect-1
       and
      GlobalProtect-2
      .
      Specify the Prisma Access
      Service IP
       address in the
      Remote IP
       field.
      Select the
      Local IP
       address from the list of WAN interface IP addresses.
    9. Use the 3rd party IPSec tunnels in a Business Intent overlay policy by selecting
      Business Intent Overlay
       and configuring the
      Peer/Service
       in the
      Policies
       area.
    10. Order the
      GlobalProtect-1
      GlobalProtect-2
       service to the
      Preferred Policy Order
       field in the Internet Traffic area.
      Defining the order in the
      Preferred Policy Order
       configures the GlobalProtect-1 tunnel to automatically fail over to the GlobalProtect-2 if the GlobalProtect-1 goes down. When both tunnels from the branch to GPCS are down, Silver Peak uses any other defined path such as local breakout or backhaul using the Overlay.

    Support for Two Active-Active Connections

    Two connections from a branch as active-active on Prisma Access are implemented as two separate remote network connections. You must onboard the connections in two separate locations using one of the following methods:
    • Configure two separate remote networks in two different compute locations and specify subnets that overlap (overlapping subnets) for each remote network.
    • Onboard both remote networks to the same compute location, making sure that the bandwidth for that compute location is sufficient to support two tunnels.
      The Silver Peak SD-WAN manually injects branch subnets into Prisma Access, but return traffic might not travel through the same tunnel if you use the same branch subnets for both tunnels. To avoid asymmetric traffic paths, configure different branch subnets for each primary tunnel.
    1. To load balance between the two tunnels, use identical names under Peer/Service. For example, if you use a Peer/Service name
      GlobalProtect
       for the tunnels PrismaAccess-1 and PrismaAccess-2, traffic will load balance between the two tunnels.
      The following figure shows the different branch subnets configured in Prisma Access for the load-balanced tunnels.
      The following figure shows Prisma Access in two locations in the
      Remote IP
       area and the peer service configured as
      GlobalProtect
       in the
      Peer/Service
       area.
      The following figure shows
      Send to GlobalProtect
       configured in the
      Preferred Policy Order
       field.

    Recommended For You

    Recommended Videos

    Recommended videos not found.

    © 2023 Palo Alto Networks, Inc. All rights reserved.

    Techdocs Logo