Prisma Access SASE Security: Design and Operation (EDU-318)

Explore Panorama managed Prisma Access and its single pane for on-prem and cloud deployments, reusing existing policies, device groups, and templates.

Discover the Prisma Access service infrastructure, the cloud foundation that connects mobile users, data centers, and branch offices, and plan subnets, IP addresses, and BGP ASN to prevent routing conflicts.

Design resilient service connections by enforcing redundancy at every layer, from Prisma Access with HA and dual compute locations, to dual IPsec tunnels, data center firewalls, and dual internet circuits.

Explain how branch users reach region-specific data centers via Prisma Access, remote security processing node, and service connection, with failover to the other data center when tunnels fail.

Explore how traffic from data center one travels through a Prisma Access service connection to data center two, with routing checks at each hop and sync between data centers.

Explore how the Prisma Access GTN connector enables zero trust network access to private data center apps through automatic tunnels from GT to the GTA connector.

Compare the GTN connector and service connection in Prisma Access, highlighting automatic tunnel establishment and location discovery with GTN, overlapped network access, and ten gbps versus one gbps throughput.

Master a planning checklist to activate Prisma Access for Panorama Managed, including activation email/link, cloud service plugin requirements, DNS and NTP configuration, and CSP portal verification.

Explore predefined IPsec tunnels and gateways in Prisma Access for third-party sd-wan devices. Learn how to reuse, customize, or backup these configurations via Panorama Service Connection and remote network templates.

Configure a service connection with BGP routing from Panorama to Prisma Access, enable route summarization and no export community, then commit and push to Prisma Access.

Explore device groups in SD-WAN networks, Panorama, and Palo Alto firewalls to group policies and objects by data centers, branches, or regions within a hierarchical device group structure.

Understand how device group objects define scope across shared and local groups, how inheritance and duplication determine object precedence in policies.

Explore Prisma Access zones, including trust, untrust, and clientless VPN, and how Prisma Access manages zones and interfaces while customers create security policies mapped to these zones.

Allocate bandwidth for remote networks in Prisma Access by selecting the compute location and Mbps, then commit and post the changes to Prisma Access.

Onboard remote networks with a single ipsec tunnel and bgp in prisma access, configuring the ipsec termination node, predefined templates, and optional backup paths.

Learn how to configure mobile user templates and device groups in Prisma Access, manage a parent device group with inherited security policies via Panorama, and commit and push changes.

Learn to upgrade the GlobalProtect app for mobile users in Prisma Access via Panorama, including activation and commit and push of the new version.

Discover how explicit proxy works with Prisma Access: a pac file routes browser traffic to the proxy, where ssl decryption, saml authentication via acs, and policy checks govern access.

Configure explicit proxy in prisma access with valid licenses and ssl decryption for https traffic. Enforce tls 1.3, note http/2 downgrades, and plan for pac file, idp reachability, saml authentication.