>
    Strata Copilot
    Configure Security Prefixes
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma SD-WAN
    3. Prisma SD-WAN Administrator’s Guide
    4. Prisma SD-WAN Stacked Security Policies
    5. Configure Security Prefixes
    Download PDF
    Prisma SD-WAN

    Configure Security Prefixes

    Table of Contents

    Configure Security Prefixes

    Learn how to configure local and global security prefixes.
    Where Can I Use This?What Do I Need?
    • Prisma SD-WAN (Managed by Strata Cloud Manager)
    • Prisma SD-WAN
    A prefix is a group of one or more individual IP addresses or IP address subnets. Prefixes are a construct of stacked policies which help to identify traffic. With security policies, prefix filters restrict access within a branch and filter out traffic to specific IP addresses within the particular source and destination zones. As with application definitions, you can reuse prefix filters across the rules and policy sets you have created for security policy rules.
    Prefixes can be either global or local in scope.
    • Global prefix filters use the same set of prefixes. By applying the global prefix filters defined for custom applications, leverage the security policy application definition.
    • Local prefixes are used when specific prefix values change by branch location. Use local prefixes to simplify creation and administration of rules. For example, a subset of IP addresses within a subnet. Use local prefixes to create a single policy across all sites to describe application behavior, eliminating the need to develop individual policies on a per-site basis.
    Avoid implementing or modifying prefix filters with excessively high counts of prefixes. Large prefix lists are not a recommended security policy practice, as they can exhaust the ION device’s memory and lead to Out Of Memory (OOM) failures.
    • Configure global security prefixes.
      1. Select ConfigurationPrisma SD-WANPoliciesSecurityGlobal Security PrefixesCreate Global Prefix.
      2. On the Add Global Prefix screen, enter a name and description for the prefix.
      3. Enter an IP and subnet address.
        IP addresses within a prefix are defined by the subnet. For example, 10.1.1.0/24 defines the entire limit of 255 IP addresses in that subnet.
      4. Select NGFWSECURITY in the Create for policy Type(s) section to create the prefix for security policies.
        (Optional) You can create a copy of this prefix filter to be used in Path, QoS, and NAT policies respectively by selecting the respective check boxes.
    • Configure local security prefixes.
      1. Select ConfigurationPrisma SD-WANPoliciesSecurityLocal Security PrefixesLocal Global Prefix.
      2. On the Create Local Prefix screen, enter a name and description for the prefix.
      3. Select NGFWSECURITY in the Create for policy Type(s) section to create the prefix for security policies.
        (Optional) You can create a copy of this prefix filter to be used in Path, QoS, and NAT policies respectively by selecting the respective check boxes.
        You must attach a local prefix to a site for the prefix to work.

    Attach Local Security Prefixes to Sites

    Local prefixes must be attached to sites in order for the prefixes to take effect.
    1. Select ConfigurationPrisma SD-WANPoliciesSecurityLocal Security Prefixes.
    2. Click Bind Site for a local prefix filter.
    3. On the Site Bindings screen, click Bind New Site.
    4. Select a site to attach the prefix filter and click Submit.

    © 2026 Palo Alto Networks, Inc. All rights reserved.