Understand Service and Data Center Groups
Table of Contents
Expand all | Collapse all
-
- QoS CIR Support For Aggregate Bandwidth
- Prisma Access for Networks Non-Aggregate Bandwidth Licensing
- IPSec Termination Nodes in Prisma
- IPSec Termination Node Logic (Panorama Managed)
- Determine Region Bandwidth Utilization
- Determine IPSec Termination Nodes Method #1 (Remote Networking On-Boarding)
- Determine IPSec Termination Nodes Method #2 (Panorama API Method)
- IPSec Termination Node Conventions and Tag Nomenclature
-
- Onboard a Non-ECMP Site
- Set Additional Information Tag
- Configure BGP
- Assign Interface-Level Tags for Non-ECMP Sites
- Customize Prisma Access Objects Names using CloudBlade Tag
- Prisma Access for Networks Region List
- Prisma Access CloudBlade Tag Information
- Edit Application Policy Network Rules
- Understand Service and Data Center Groups
- Verify Standard VPN Endpoints
- Configure Standard Groups
- Assign Domains to Sites
- Use Groups in Network Policy Rules
- Enable, Pause, Disable, and Uninstall the Integration
-
- Monitor the Prisma Access for Networks (Panorama Managed) CloudBlade
- Understand Prisma SD-WAN and Prisma Access for Networks Integration
- Correlate Objects between Prisma SD-WAN and Panorama
- View Standard VPNs at a Site Level
- View Alerts and Alarms
- View Activity Charts
- Use the Device Toolkit
- Check Tunnel Status on Panorama
- Change Existing Panorama Serial Number Post CloudBlade Integration
Understand Service and Data Center Groups
316 PIC
Prisma SD-WAN
uses mapping of standard
services and Prisma SD-WAN
data centers to allow flexibility when
creating network policy rules, while accounting for uniqueness across
sites. For example, an administrator may want to create a single
network policy that directs all HTTP and SSL Internet bound traffic through
the primary Palo Alto Prisma Access
for Networks in the region if
it is available. If not available, it may leverage the backup Palo
Alto Prisma Access
for Networks in the region. Now, the administrator
will have different primary and backup cloud security service endpoints
based on their geographic location. Regardless of the site location,
the intent and the policy rules will remain the same.This is where the concept of endpoints, groups, and domains come
into play. To leverage the underlying resources available to an
administrator, it is important to understand how an endpoint, group,
and domain work in the
Prisma SD-WAN
system.- Endpoint—A service endpoint is a label representing a specific location or network service. It can be of typePrisma SD-WAN, specificallyPrisma SD-WANData Centers for Data Center transit services, or of type standard.
- Group—A service group is a label representing a set of common service endpoint types. This service group label will be used in network policy rules to express intent to allow or force traffic to the defined service endpoints. It can be of typePrisma SD-WANor standard and may contain zero or more service endpoints.
- Domain—A domain is a collection of groups which can be assigned to a set of sites. There can be multiple domains defined, but a site may only be assigned to one domain at a time.
A site will be able to use only the endpoints configured
in a group within a domain that is assigned to the site. The same
group, however, can be in multiple domains with different service
endpoints, allowing you to use the same policy across different
sites utilizing different endpoints.
Let us further explore the concept of endpoints, groups, and
domains using the following illustration.
![](/content/dam/techdocs/en_US/dita/_graphics/uv/prisma/prisma-sd-wan/cloudblades/understand-service-and-data-center-groups.jpg)
The illustration displays how endpoints added to a group are
associated with a domain. The domains are then bound to a site,
thus mapping standard services or
Prisma SD-WAN
data centers uniquely
for each site.A group, with different endpoints, can be mapped to one
or more domains and a domain can be mapped to one or more sites.
Another example to illustrate the concept is shown. For a customer
with sites in North America and Europe that has one
Prisma SD-WAN
-enabled
data center in each region and has adopted a Palo Alto Prisma Access
for Networks within each region, with two geographic locations in
each region, domain mapping is accomplished as follows:![](/content/dam/techdocs/en_US/dita/_graphics/uv/prisma/prisma-sd-wan/cloudblades/understand-service-and-data-center-groups1.jpg)
The same endpoint can be added to more than one group.
Only one active group and one backup group may be used in a network
policy rule.