Onboard PAN-OS Firewalls to

Prisma Access

Log in to the Panorama Web Interface.
Specify the BGP local address pool for loopback addresses.
Select
Panorama
SD-WAN
VPN Clusters
.
At the bottom of the screen, select
BGP Prisma Address Pool
.
Add
an unused private subnet (prefix and netmask) for the local BGP addresses for
Prisma Access
.
Click
OK
.
Commit
.
Do not simply change an existing address pool if
Prisma Access
is already onboarded. If you need to change an address pool, perform the following steps during a maintenance window to update the SD-WAN branch and the
Prisma Access
CN with your address pool changes:
Use Panorama to access an SD-WAN branch and delete the existing onboarding that the address pool change will impact; then do a local Commit.
Update the VPN address pool, and then do a local Commit.
Perform the
Prisma Access
onboarding again, and then do a local Commit and Push.
Select the SD-WAN branch firewall to connect to the
Prisma Access
hub and configure the connection.
Select
Panorama
SD-WAN
Devices
.
Select the branch firewall on which you enabled SD-WAN, whose name then populates the
Name
field.
Select the
Type
of device as
Branch
.
Select the
Virtual Router Name
.
Enter the
Site
.
All SD-WAN devices must have a unique Site name.
Select
Prisma Access Onboarding
and
Add
.
Select a local, SD-WAN-enabled
Interface
on the firewall to connect to the
Prisma Access
hub.
Select a
Prisma Access
Tenant
(select
default
for a single tenant environment).
All SD-WAN interfaces on a branch firewall must use the same
Prisma Access
tenant.
Enter a helpful
Comment
.
Add
a compute node to a
Region
by selecting the region where the CN (
Prisma Access
hub) is located.
There can be multiple regions per interface.
Select an
IPSec Termination Node
(GP gateway) from the list of nodes; the list is based on the nodes that
Prisma Access
spun up for the region earlier. You are choosing the hub to which this branch connects. SD-WAN Auto VPN configuration builds IKE and IPSec relationships and tunnels with this node.
Enable
BGP for communication between the branch and hub (Enable is the default).
Advertise Default Route
to allow the
Prisma Access
hub’s default route to be advertised to the branch firewall.
Summarize Mobile User Routes before advertising
to have the
Prisma Access
hub advertise summarized mobile user IP subnet routes, thereby reducing the number of advertisements to the branches.
Don’t Advertise Prisma Access Routes
to prevent the IPSec Termination Node/hub from advertising its
Prisma Access
routes to the SD-WAN branches.
Enter the
Secret
for authentication of BGP communications and
Confirm Secret
.
Select a
Link Tag
for the hub.
When you want to enable ECMP for a
Prisma Access
hub, onboard more than one branch interface to the same compute node (CN) and use the same Link Tag on those branch interfaces.
Click
OK
. The display will include a Peer AS number and the Tunnel Monitor IP address provided by
Prisma Access
.
Commit and Push
the configuration to the cloud, where
Prisma Access
spins up the correct number of IPSec Termination Nodes based on requested bandwidth.
When more than one IPSec tunnel is going to the same CN, the
Prisma Access
configuration has ECMP enabled with symmetric return, as shown in this
Prisma Access
example:
Verify that onboarding is complete.
Select

Panorama

Cloud Services

Status

and verify that the Remote Networks Deployment Status displays

success

.

Select the Remote Networks Deployment Status

details

.

Confirm that the

Prisma Access

node completion displays 100%.
Synchronize the branch firewall to
Prisma Access
to retrieve the service IP address(es) of the CNs.
Select

Panorama

SD-WAN

Devices

.

Select the SD-WAN branch device.

Select

Prisma Access Onboarding

and

Sync To Prisma

(and respond to message to continue). Repeat for each branch device.

After the sync to Prisma is successful, you will see the

Prisma Access

configuration parameters on the SD-WAN branch firewall. If not, wait for approximately 15 minutes and repeat the Sync to Prisma. If necessary, go to the

Prisma Access

plugin and verify that the CN onboarding has finished (you can see the CN with the bandwidth and IP addresses assigned). After that verification, retry Sync To Prisma.
Commit
to Panorama.
Push to Devices
to push to the local branch firewall.
Edit Selections
to select the Push Scope Selection. Select the correct
Template
and
Device Group
.
On the branch firewall, select
Network
Interfaces
SD-WAN
and see the new interface that was created with the Link Tag you created, assigned to the Security Zone named
zone-to-pa-hub
, and with the IPSec tunnel connecting to the CN.
Select
Network
IPSec Tunnels
and verify the IPSec tunnel is up.
Select
Network
Network Profiles
IKE Gateways
and verify the IKE gateway is up.
Create an SD-WAN policy rule to generate monitoring data.
This step is required to baseline
Prisma Access
Hub latency, jitter, and packet loss data for accurate traffic distribution. SD-WAN monitoring data is generated from traffic that matches your SD-WAN policy rules.
Create a Traffic Distribution Profile.
Create a Path Quality Profile with high latency, jitter, and packet loss thresholds.
A Path Quality profile is required to create a SD-WAN policy rule. Creating a Path Quality profile with high thresholds allows you to baseline latency, jitter, and packet loss for the
Prisma Access
Hub without causing app to swap to a different link.
Configure an SD-WAN Policy Rule.
Commit
and
Commit and Push
to branch firewalls.
Refresh the Prisma IKE preshared key.
If you need to change the current Prisma IKE key that is used to secure the IPSec connection between branch and the Prisma hub, perform this step to randomly generate a new key for the tunnel and update both sides of the tunnel. Perform this step when the hub and branch are not busy.
Do not create an IKE gateway manually with a name beginning with “gw_” because such names are reserved for Prisma IKE creation during onboarding. This step to refresh the Prisma IKE preshared key refreshes all such named IKE gateways if there are any apart from those created by
Prisma Access
.
Select
Panorama
SD-WAN
Devices
and select a device.
At the bottom of the screen, select
Refresh Prisma IKE Key
.
A message appears notifying you that
Refreshing the IKE key will update all SD-WAN tunnels between the branch and the
Prisma Access
hub and will require a simultaneous configuration push to all branch and
Prisma Access
hub devices. Best practice recommendation is to perform the refresh during a maintenance window as traffic can be affected. Do you wish to continue?
Select
Yes
if you wish to continue.
Commit
and
Commit and Push
to branch firewalls.
Monitor Prisma Access Hub Application and Link Performance to understand the baseline latency, jitter, and packet loss for the links to
Prisma Access
.
This step is required to gather accurate latency, jitter, and packet loss data to fine-tune your
Prisma Access
Hub Path Quality profiles.