: Edit Application Policy Network Rules
Focus
Focus

Edit Application Policy Network Rules

Table of Contents

Edit Application Policy Network Rules

312 PIC
When the IPsec Tunnels are active from the site to the Prisma Access Regions, the next step is to modify policies to send traffic down these tunnels. To begin this process, we must modify Service and Data center groups and configure these groups in policy.
When making policy configurations, remember that the ION devices makes intelligent per-app selections using the network policies to chain multiple different path options together in Active-Active and Active-Backup modes.
Example:
  • Application A: Take Standard VPN direct to Prisma Access.
  • Application B: Take Standard VPN direct to Prisma Access, Backup to Direct Internet.
  • Application C: Use only Direct Internet.
The Prisma SD-WAN secure Application Fabric (AppFabric) enables granular controls for virtually unlimited number of policy permutations down to the sub-application level. Here are some of the most common examples of how a traffic policy can be configured per-application:
  • Send all internet-bound traffic from a set of branches to Prisma Access. (Blanket Suspect list)
  • Send all internet traffic direct to the internet except for certain applications needing additional inspection or security. (Suspect list - Safelist)
  • Send all internet-bound traffic from a set of branches to Prisma Access except for specific known applications. (Suspect list - Safelist)
In order to modify application policy, the following steps should be performed. They are detailed in the following sections: