Learn how to edit the application policy network rules in the native SASE integration for
Prisma SD-WAN.
| Where Can I Use
This? | What Do I Need? |
|---|
|
|
- Prisma SD-WAN
Active Prisma SD-WAN
license Prisma SD-WAN AppFabric deployed
at one or more locations. Physical and/or virtual ION devices running
software versions 5.6.X or higher.
- Prisma Access Cloud Managed
- Prisma Access with Aggregate Bandwidth; the
bandwidth licensing mode must be enabled per compute
location on the Prisma Access Cloud Managed
portal.
- Identification of the IPSec Termination Nodes within
Prisma Access for connectivity.
- Ensure that you have Prisma Access (Cloud Managed) and
Prisma SD-WAN in the same TSG.
|
When the IPSec tunnels are active from the Prisma SD-WAN sites to the Prisma Access regions, the
next step is to modify policies to send traffic down these tunnels. To begin this
process, we must modify Service and Data center groups and configure these groups in
policy.
When making policy configurations, remember that
the ION devices makes intelligent per-app selections using the network
policies to chain multiple different path options together in Active-Active
and Active-Backup modes.
Example:
- Application A: Take Standard VPN direct to Prisma Access.
- Application B: Take Standard VPN direct to Prisma Access, Backup to Direct Internet.
- Application C: Use only Direct Internet.
The Prisma SD-WAN secure Application Fabric (AppFabric) enables granular controls for virtually
unlimited number of policy permutations down to the sub-application level. Here are
some of the most common examples of how a traffic policy can be configured
per-application:
- Send all internet-bound traffic from a set of branches to Prisma Access. (Blanket Suspect list)
- Send all internet traffic direct to the internet except for certain applications needing
additional inspection or security. (Suspect list—Safelist)
- Send all internet-bound traffic from a set of branches to Prisma Access except for specific
known applications. (Suspect list—Safelist)
In
order to modify application policy, the following steps should be
performed. They are detailed in the following sections:
