: Use Service Endpoint Groups in Policies
Focus
Focus

Use Service Endpoint Groups in Policies

Table of Contents

Use Service Endpoint Groups in Policies

Learn more about the use of service endpoint groups in policies.
Where Can I Use This?What Do I Need?
  • Prisma SD-WAN
  • Active Prisma SD-WAN license
You must define service endpoint groups before using a standard VPN in a policy rule. Each group can have one or more Prisma SD-WAN data centers or standard service endpoints. A group is used in policy rules. You must bind domain to sites to define mappings for endpoints to groups groups. This ensures the policy rules using the group is effective.
If you choose standard VPN as a path to allow traffic to transit through a standard endpoint, you must have a standard service and DC group defined with the appropriate endpoints associated.
There can be four combinations of active or backup groups that can be used in policies. You can select only one Palo Alto Networks group or one non-Palo Alto Networks group as an active or backup path in policies. The following table explains the combinations of the active or backup groups in policies.
Active GroupBackup GroupExample
StandardPalo Alto NetworksInternet-bound SSL traffic from a branch site transits through the Cloud Security Service. If all standard VPN paths to any of the endpoints are not available, internet-bound SSL traffic transits through one of the Prisma SD-WAN data center endpoints assigned to that group using the Palo Alto Networks VPN.
Palo Alto NetworksStandardInternet-bound SSL traffic from a branch site transits through one of the Prisma SD-WAN data center endpoints assigned to that group using the Palo Alto Networks VPNs. If all Palo Alto Networks VPNs to all of the data center endpoints in that group are unavailable, internet-bound SSL traffic transits through the Cloud Security Service using one of the standard VPN paths to any of the endpoints in the standard group.
StandardStandardInternet-bound SSL traffic from a branch site transits through the primary Cloud Security Service using one of the standard VPN paths to any of the endpoints in the primary Cloud Security Service group. If all standard VPNs are down to all endpoints in the primary group, the internet-bound SSL traffic transits through the backup Cloud Security Service using one of the standard VPN paths to the endpoints that are part of the backup group.
Palo Alto NetworksPalo Alto NetworksInternet-bound SSL traffic from a branch site transits through one of the Prisma SD-WAN data center endpoints assigned to the active group using the Palo Alto Networks VPNs. If all Palo Alto Networks VPNs to all of those endpoints are down, internet-bound SSL traffic transits through one of the Prisma SD-WAN data center endpoints assigned to the backup group using the Palo Alto Networks VPNs.