Understand Service and Data Center Groups
Table of Contents
Expand all | Collapse all
-
-
- Add a Branch
- Add a Data Center
- Add a Branch Gateway
- Configure Circuits
- Configure Internet Circuit Underlay Link Aggregation
- Configure Private WAN Underlay Link Quality Aggregation
- Configure Circuit Categories
- Configure Device Initiated Connections for Circuits
- Add Public IP LAN Address to Enterprise Prefixes
- Manage Data Center Clusters
- Configure a Site Prefix
- Configure a DHCP Server
- Configure NTP for Prisma SD-WAN
- Configure the ION Device at a Branch Site
- Configure the ION Device at a Data Center
- Switch a Site to Control Mode
- Allow IP Addresses in Firewall Configuration
-
- Configure a Controller Port
- Configure Internet Ports
- Configure WAN/LAN Ports
- Configure a Loopback Interface
- Configure a PoE Port
- Configure and Monitor LLDP Activity and Status
- Configure a PPPoE Interface
- Configure a Layer 3 LAN Interface
- Configure Application Reachability Probes
- Configure a Secondary IP Address
- Configure a Static ARP
- Configure a DHCP Relay
- Configure IP Directed Broadcast
- VPN Keep-Alives
-
- Configure Prisma SD-WAN IPFIX
- Configure IPFIX Profiles and Templates
- Configure and Attach a Collector Context to a Device Interface in IPFIX
- Configure and Attach a Filter Context to a Device Interface in IPFIX
- Configure Global and Local IPFIX Prefixes
- Flow Information Elements
- Options Information Elements
- Configure the DNS Service on the Prisma SD-WAN Interface
- Configure SNMP
-
-
- Prisma SD-WAN Branch Routing
- Prisma SD-WAN Data Center Routing
-
- Configure Multicast
- Create a WAN Multicast Configuration Profile
- Assign WAN Multicast Configuration Profiles to Branch Sites
- Configure a Multicast Source at a Branch Site
- Configure Global Multicast Parameters
- Configure a Multicast Static Rendezvous Point (RP)
- Learn Rendezvous Points (RPs) Dynamically
- View LAN Statistics for Multicast
- View WAN Statistics for Multicast
- View IGMP Membership
- View the Multicast Route Table
- View Multicast Flow Statistics
- View Routing Statistics
- Prisma SD-WAN Incident Policies
-
- Prisma SD-WAN Branch HA Key Concepts
- Configure Branch HA
- Configure HA Groups
- Add ION Devices to HA Groups
- View Device Configuration of HA Groups
- Edit HA Groups and Group Membership
-
- Configure Branch HA with Gen-1 Platforms (2000, 3000, 7000, and 9000)
- Configure Branch HA with Gen-2 Platforms (3200, 5200, and 9200)
- Configure Branch HA with Gen-2 Embedded Switch Platforms (1200-S or 3200-L2)
- Configure Branch HA for Devices with Software Cellular Bypass (1200-S-C-5G)
- Configure Branch HA for Platforms without Bypass Pairs
- Prisma SD-WAN Clarity Reports
- Prisma SD-WAN Incidents and Alerts
Understand Service and Data Center Groups
Understand Service and Data Center Groups in
Prisma SD-WAN
.Where Can I Use This? | What Do I Need? |
---|---|
|
|
Prisma SD-WAN
uses mapping of standard services and Prisma SD-WAN
data centers to
allow flexibility when creating network policy rules, while accounting for uniqueness
across sites. For example, an administrator may want to create a single network policy
that directs all HTTP and SSL Internet bound traffic through the primary Palo Alto
Prisma Access
for Networks in the region if it is available. If not available, it may
leverage the backup Palo Alto Prisma Access
for Networks in the region. Now, the
administrator will have different primary and backup cloud security service endpoints
based on their geographic location. Regardless of the site location, the intent and the
policy rules will remain the same.This is where the concept of endpoints, groups, and domains come into play. To leverage the
underlying resources available to an administrator, it is important to understand how an
endpoint, group, and domain work in the
Prisma SD-WAN
system.- Endpoint—A service endpoint is a label representing a specific location or network service. It can be of typePrisma SD-WAN, specificallyPrisma SD-WANData Centers for Data Center transit services, or of type standard.
- Group—A service group is a label representing a set of common service endpoint types. This service group label will be used in network policy rules to express intent to allow or force traffic to the defined service endpoints. It can be of typePrisma SD-WANor standard and may contain zero or more service endpoints.
- Domain—A domain is a collection of groups which can be assigned to a set of sites. There can be multiple domains defined, but a site may only be assigned to one domain at a time.
A site will be able to use only the endpoints configured
in a group within a domain that is assigned to the site. The same
group, however, can be in multiple domains with different service
endpoints, allowing you to use the same policy across different
sites utilizing different endpoints.
Let us further explore the concept of endpoints, groups, and
domains using the following illustration.
![](/content/dam/techdocs/en_US/dita/_graphics/uv/prisma/prisma-sd-wan/prisma-sd-wan-admin/stacked-ep-groups-domains.png)
The illustration displays how endpoints added to a group are associated with a domain. The
domains are then bound to a site, thus mapping standard services or
Prisma SD-WAN
data
centers uniquely for each site.A group, with different endpoints, can be mapped to one
or more domains and a domain can be mapped to one or more sites.
Another example to illustrate the concept is shown. For a customer with sites in North America
and Europe that has one
Prisma SD-WAN
-enabled data center in each region and has adopted
a Palo Alto Prisma Access
for Networks within each region, with two geographic locations
in each region, domain mapping is accomplished as follows:![](/content/dam/techdocs/en_US/dita/_graphics/uv/prisma/prisma-sd-wan/prisma-sd-wan-admin/native-integration-service-dc-groups.png)
The same endpoint can be added to more than one group.
Only one active group and one backup group may be used in a network
policy rule.