Connect a Single Prisma SD-WAN Site to Prisma Access

1. Configure SASE connectivity.
   This is a one-time activity.
   1. Select ManageResourcesSASE Connectivity.

   2. Enter an ION Peering Default Local AS Number.
      The BGP Local AS number is defined to quickly on-board ECMP sites. This can be a 16-bit AS number, but private BGP AS number(s) are recommended.
   3. Specify a Tunnel Inner IP Pool using IP/Mask notation.
      This IP Pool should be unused or unique across the entire network and should not be used by the Palo Alto Service Infrastructure Subnet.

      The number of tunnels that can be created in the Prisma SD-WAN Fabric to Prisma Access are directly limited by this configuration. Each tunnel will use a /31 subnet from this pool.
   4. (Optional) Select a Security Zone to bind the tunnel(s) created in the onboarding process to the selected zone.
      If you don’t select a Security Zone, the created tunnels will not be bound to a security zone.
2. Select WorkflowsPrisma SD-WAN SetupBranch Sites.
3. Click Connect to Prisma Access for the site that you want to connect to Prisma Access under Prisma Access Connection.
4. Select a Prisma Access Location.

   Prisma Access recommends the first location in the list closest to the Prisma SD-WAN site address. The recommendation is based on the address (latitude and longitude values) entered during site creation in Prisma SD-WAN.
5. Select the corresponding IPSec Termination Node.
   For every 1 Gbps of bandwidth allocated to a Prisma Access region, a new Termination Node is spun up; you can accordingly select a different termination node.
6. Click Connect Sites.
   You can view the status of the connection in the SASE Connection column.

   For each Prisma SD-WAN circuit for a site, a corresponding tunnel to Prisma Access is created in this process. You can have a maximum of 4 circuits connecting to Prisma Access for a site.
7. (Optional) You can view the details of the Prisma Access peer by selecting WorkflowsPrisma SD-WAN SetupBranch SitesSelect a SiteOverlay ConnectionsBranch-Standard VPN.
8. (Optional) To view additional information for SASE connectivity:
   1. Select WorkflowsPrisma SD-WAN SetupBranch Sites and select a site.
   2. View details in the Prisma Access Connectivity section.

   3. (Optional) Click Edit to update the service connectivity details.
      1. Select the Active Prisma Access Location and/or the IPSec Termination Node.
         You can view the Allocated Bandwidth for each Prisma Access Location.
      2. Click Next to update the remote network tunnel configuration details.
      3. Click the pencil icon to update the details for a tunnel.

      4. Click Update.