>
    Configure Prisma Access Colo-Connect
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access
    3. Prisma Access Colo-Connect
    4. Configure Prisma Access Colo-Connect
    Download PDF
    Prisma Access

    Configure Prisma Access Colo-Connect

    Table of Contents

    Configure Prisma Access Colo-Connect

    Configure a Colo-Connect deployment in Prisma Access.
    Where Can I Use This?What Do I Need?
    • Prisma Access (Managed by Strata Cloud Manager)
    • Prisma Access (Managed by Panorama)
    • A Prisma Access (Managed by Panorama) deployment running a minimum Cloud Services plugin version of 4.1 and a minimum dataplane version of 10.2.4
    • A Colo-Connect add-on license
    Prisma Access Colo-Connect consists of the following components:
    • Colo—The colocation facility that provides rack-space, power and connectivity to host networking, private and public cloud infrastructure, such as Equinix.
    • Dedicated Interconnect—The dedicated Layer 2 or Layer 3 physical connection between your router and a GCP edge router in a given GCP compute region. A dedicated Interconnect provides a direct physical connection between your on-premises network and the Google network.
      Interconnects are called Links in the Prisma Access UI.
    • GCP VLAN Attachment—The logical Layer 2 connection over the link that separates traffic from any other logical connections sharing the same link.
      VLAN attachments are called Connections in the Prisma Access UI.
    • Partner Interconnect—The Layer 3 physical connection between a service provider owned router and a GCP edge router in a given GCP compute region. A partner Interconnect provides connectivity between your on-premises and VPC networks through a supported service provider.
      Colo-Connect supports both Dedicated and Partner interconnects.
    • Colo (Customer) Router—The routing device in the Colo facility that establishes eBGP with the GCP cloud router over the interconnect in the Colo facility, as well as eBGP with Colo-Connect service connection over the GRE tunnel. It is a customer router for a dedicated interconnect, or if the service provider has Layer 2 connectivity with GCP over the partner interconnect. The service provider owns the Colo router when it has Layer 3 connectivity with the GCP cloud-router.
    • GCP Edge Router—GCP's network edge equipment to provide physical connectivity between GCP and the customer/partner network via the Colo.
    • Cloud Router—The GCP software construct in the cloud that establishes BGP sessions with the networking device (for example, router or Layer 3 firewall) in the Colo and routes traffic between Prisma Access and your network. You are not required to configure this component; it is automatically done by Prisma Access.
    To configure Colo-Connect, you must first gather information about your existing network environment and make sure that you have all required network components in place. Ensure you have all prerequisites; then, deploy Colo-Connect in your organization's network using either a partner or a dedicated interconnect.

    Configure Prisma Access Colo-Connect (Strata Cloud Manager)

    Configure a Colo-Connect deployment in Prisma Access.
    To configure Colo-Connect, you must first gather information about your existing network environment and make sure that you have all the required network components in place. Ensure you have all prerequisites; then deploy Colo-Connect in your organization's network using either a partner or a dedicated interconnect.

    Configure Prisma Access Colo-Connect—Deployments Using Partner Interconnects

    To configure Prisma Access Colo-Connect using a partner interconnect, complete these steps.
    1. Create subnets for your Colo-Connect connections.
      You use the subnets you create here in the connections and service connections that you create in later steps.
      1. From Strata Cloud Manager, go to WorkflowsPrisma Access SetupColo-Connect.
      2. Add Prefix and add a Colo-Connect subnet a Prisma Access location for it.
        See the list of supported colo-connect locations here. Enter a minimum subnet of /28.
      3. (Optional) If you plan on creating Colo-Connect instances for more than one location, add more subnets on a per-location basis.
        You can configure one subnet per location.
    2. Add a new Colo-Connect link (also known as the interconnect).
      1. Go to WorkflowsPrisma Access SetupColo-Connect and Add Link.
      2. Give the link a unique Link Name.
      3. Select Partner interconnect as the Link Type.
      4. Specify the remaining Colo-Connect link parameters.
        • Select either 10Gbps or 20Gbps for the Bandwidth.
        • Select either Zone1 or Zone2 for the Edge Availability Domain. Take this value from the GCP zone used for your edge availability domain.
        • Enter the Organization Name to use for this link.
        • Enter the Email to use for this link. Any email address is acceptable.
      5. Repeat steps 2.a to 2.d and create another link with a different Edge Availability Domain.
    3. Create the connections (also known as the VLAN attachments) for Colo-Connect.
      1. Go to WorkflowsPrisma Access SetupColo-Connect and Add Connection.
      2. Configure the connection settings.
        • Enter a unique Connection Name.
        • Select a Link Name from the links you configured in a previous step.
          You do not need to enter a VLAN ID; it's not configurable for VLANs created on partner interconnects.
        • Select a Bandwidth for the connection.
          You can select between 1 Gbps, 2 Gbps, 5 Gbps, 10 Gbps, or 20 Gbps.
          If you configure multiple connections for an interconnect, make sure that the total bandwidth of the connections does not exceed the bandwidth of the interconnect. For example, given a partner interconnect of 10 Gbps, you can configure 10 connections of 1 Gbps each, but don't exceed 10 Gbps in total for all connections.
          If your deployment requires more than 16 connections, reach out to your Palo Alto Networks account team, who will open an SRE case to accommodate the request.
        • Enter a BGP Peer ASN.
          Enter the Autonomous System (AS) number for the customer on-premises router in the Colo. The range is between 1 and 4294967295.
        • Select the Location from the connection names you created in a previous step.
          You must have already added a subnet for any location you specify.
        • (Optional) Enter the BGP MD5 Secret.
      3. Continue to create connections until complete.
        Create two connections. Both connections must be in the same region and one connection each must be in a separate zone. You use these connections in service connections you create in a later step.
    4. Push Config.
      Refresh the browser after the commit job is complete to view the pairing keys under Connections.
    5. Retrieve the Pairing Key and complete your partner interconnect configuration in GCP.
      You use this pairing key when you set up the partner interconnect in the Colo.
      When you first onboard a new connection, the Status in the Connections area shows a Status of PENDING_PARTNER and a BGP Status of DOWN. To bring the connection status to ACTIVE, retrieve the pairing key and input in the connection at the Colo.
      1. Go to WorkflowsPrisma Access SetupColo-ConnectConnections and copy the Pairing Key.
      2. Create a new VLAN connection in the Colo.
      3. Paste the Pairing Key in the Colo VLAN.
        GCP detects when the pairing key is consumed, brings the VLAN status to ACTIVE, and generates the BGP IP address for you to configure on your on-premises router in the Colo. Prisma Access uses these IPs to initiate eBGP adjacency over each associated VLAN between Colo router and GCP cloud router.
    6. Create eBGP routing on the Customer (Colo) router for the Colo-Connect connection.
      You need to set up BGP peering to ensure connectivity between the customer router and the cloud router.
    7. Set up the service connections to use with Colo-Connect.
    8. Push Config.
    9. Check the status of the Colo-Connect connections.
      1. To check the status of a service connection used by a Colo-Connect connection, go to WorkflowsPrisma Access SetupService Connection.
      2. Select ManageConfigurationNGFW and Prisma Access. Set the Configuration Scope to Prisma Access. Select the In Sync status of the Service Connections under the Prisma Access sync status. Select the region that has a Colo-Connect connection deployed.
        • If the Colo-Connect connection and the BGP routing are both up, the Status displays OK.
        • If the Colo-Connect connection is up but BGP routing isn't up, the Status displays Warning.
        • If the Colo-Connect connection and BGP routing are down, the Status displays Down.
        • If the Colo-Connect connection is down but BGP routing is up, the Status displays Error.
      3. For more information, click the region box and view the information in the Status tab.
    10. Check the connection details, including the Pairing Key, of the Colo-Connect connections by going to WorkflowsPrisma Access SetupColo Connect.

    Configure Prisma Access Colo-Connect—Deployments Using Dedicated Interconnects

    To configure Prisma Access Colo-Connect using a dedicated interconnect, complete these steps.
    1. Create subnets for your Colo-Connect connections.
      You use the subnets you create here in the connections and service connections that you create in later steps.
      1. From Strata Cloud Manager, go to WorkflowsPrisma Access SetupColo-Connect and click the gear icon to edit the settings.
      2. Add Prefix for Colo-Connect Subnet and select a Prisma Access location (PA Location) for it.
        Enter a minimum subnet of /28.
      3. (Optional) If you plan on creating Colo-Connect instances for more than one location, Add more subnets on a per-location basis.
        You can configure only one subnet per location.
    2. Add a new Colo-Connect link (also known as the interconnect).
      1. Go to WorkflowsPrisma Access SetupColo-Connect and Add Link.
      2. Give the link a unique Link Name.
      3. Select a Dedicated interconnect as the Link Type.
      4. Specify the remaining Colo-Connect link parameters.
        • Select either 10Gbps or 20Gbps for the Bandwidth.
          If you select 20 Gbps, you must aggregate the Dedicated Interconnect link into two 10 Gbps links using LACP.
          You can't change the bandwidth of a dedicated interconnect link after you specify it and commit and push your changes.
        • Select a Colo-Connect Location from the drop-down list.
          Make sure that you select the same location that you used for the dedicated interconnect.
        • Select either Zone1 or Zone2 for the Edge Availability Domain. Take this value from the GCP zone used for your edge availability domain.
        • Enter the Organization Name to use for this link.
        • Enter the Email where you want to receive the LOA-CFA details from the cloud provider.
    3. After the dedicated connection is created, the Colo facility tests your connections and informs you that they have been tested and are ready to use.
      No Prisma Access configuration is required for this step. Don't create the Colo-Connect connections in Prisma Access until the Colo facility lets you know that they have been tested.
    4. Create the connections (also known as the VLAN attachments) for Colo-Connect.
      1. Make sure that the dedicated link status is Active by going to WorkflowsPrisma Access SetupColo-ConnectColo Connect Links.
        Until the Dedicated link status is Active, you can't create Colo-Connect links.
      2. Go to WorkflowsPrisma Access SetupColo-Connect and Add Connection.
      3. Configure the connection settings.
        • Enter a unique Name for the connection.
        • Select a Link Name from the links you configured in a previous step.
        • (Optional) Enter a VLAN ID for the connection.
          VLAN IDs are generated by the interconnect vendor (GCP) if you don't manually enter a value.
        • Select a Bandwidth for the connection.
          You can select between 1 Gbps, 2 Gbps, 5 Gbps, 10 Gbps, or 20 Gbps.
          If you configure multiple connections for an interconnect, make sure that the total bandwidth of the connections does not exceed the bandwidth of the interconnect. For example, given a dedicated interconnect of 20 Gbps, you can configure 10 connections of 2 Gbps each, but don't exceed 20 Gbps in total for all connections.
        • Enter a BGP Peer ASN.
          Enter the Autonomous System (AS) number for the customer on-premises router in the Colo. The range is between 1 and 4294967295.
        • Select the Location from the connection names you created in a previous step.
          You must have already added a subnet for any location you specify.
        • (Optional) Enter the BGP MD5 Secret.
      4. Continue to create connections until complete.
        Create two connections. Both connections must be in the same region and one connection each must be in a separate zone. You use these connections in service connections you create in a later step.
    5. Push Config.
    6. Configure eBGP routing on the customer router.
      You need to set up BGP peering to ensure connectivity between the customer router.
    7. Set up the service connections to use with Colo-Connect.
    8. Commit and Push your configuration changes, making sure that Colo-Connect is selected in the Push Scope.
    9. Check the status of the Colo-Connect connections.
      1. To check the status of a service connection used by a Colo-Connect connection, go to ManageConfigurationNGFW and Prisma Access. Set the Configuration Scope to Prisma Access.
      2. Hover over a region that has a Colo-Connect connection deployed.
        • If the Colo-Connect connection and the BGP routing are both up, the Status displays OK.
        • If the Colo-Connect connection is up but BGP routing isn't up, the Status displays Warning.
        • If the Colo-Connect connection and BGP routing are down, the Status displays Down.
        • If the Colo-Connect connection is down but BGP routing is up, the Status displays Error.
      3. For more information, click the region box and view the information in the Status tab.
    10. Check the network details of the Colo-Connect connections by going to WorkflowsPrisma Access SetupColo-ConnectConnections and viewing the details.
      For dedicated links, the Pairing Key displays as N/A.

    Configure VLAN eBGP Routing on the Customer Router

    GCP creates IP addresses for the customer (Colo) router and the cloud router during these stages of your deployment:
    • For partner interconnects, GCP creates the IP addresses after the pairing key is consumed by your Colo (for example, Equinix).
    • For dedicated interconnects, GCP creates the IP addresses after you onboard your Colo-Connect connections (VLAN attachments) and commit and push your changes.
    To ensure correct routing, you must:
    • Configure the Colo router IP address (the Colo CPE IP in Prisma Access) as the local eBGP IP address
    • Configure the cloud router IP address (Cloud Router IP) as the eBGP peer address on your Colo router.
    When complete, eBGP is configured for the connection (VLAN attachment) between the Colo router and the cloud router.
    Creating this routing is the first step in setting up GRE tunnel routing. You complete the GRE tunnel routing when you set up GRE tunnels during service connection configuration.
    Use the following steps to configure routing between the Colo and the cloud router.
    1. From Strata Cloud Manager, create the subnets, links, and connections and Push Config.
      Use the workflow specific to your interconnect type (either Partner or Dedicated) For Partner interconnects, be sure that you pasted the Pairing Key into the Colo VLAN.
    2. Go to WorkflowsPrisma Access SetupColo-ConnectConnections.
    3. Make a note of the following connection elements:
      • Colo CPE IP
      • Cloud Router IP
      • Cloud Router BGP ASN
      In the following example:
      • For the vlan-central-1 connection, the Colo CPE IP is 169.254.24.170/29, the Cloud Router IP is 169.254.24.169/29, and the Cloud Router BGP ASN is 16550
      • For the vlan-central-2 connection, the Colo CPE IP is 169.254.120.74/29, the Cloud Router IP is 169.254.120.73/29, and the Cloud Router BGP ASN is 16550.
      • .
    4. Determine the IP addresses you will use for the local GRE IP addresses when you set up the Colo-Connect service connections.
      You configure these when you set up a Colo-Connect service connection (WorkflowsPrisma Access SetupService Connections). In the Peer IP 1 and, if required, Peer IP 2 areas.
      If you're configuring a service connection to support up to 10 Gbps of throughput, put one tunnel each in Connection 1 and Connection 2, for a total of two tunnels in each service connection.
      If you're configuring a service connection to support more than 10 Gbps of throughput (up to 20 Gbps), put two tunnels each in Connection 1 and Connection 2, for a total of four tunnels in each service connection.
      The following examples show a tunnel being configured for more than 10 Gbps throughput, so two tunnels per connection are used, and they use the following peer IP addresses:
      • 172.120.1.1 for Connection 1
      • 172.130.1.1 for Connection 1
      • 172.121.1.1 for Connection 2
      • 172.131.1.1 for Connection 2
    5. Log in to the Colo router.
      The following configuration screenshots use a Palo Alto Networks Next-Generation Firewall as the Colo router.
    6. Add a VLAN interface, specifying the Colo CPE IP address as the IP address.
      If you're using a next-generation firewall as the Colo router, go to NetworkInterfacesVLAN and Add the VLAN interface, specifying the Virtual Router name, and
    7. Configure the Colo router IP address (Colo CPE IP) as the local eBGP IP address and Configure the cloud router IP address (Cloud Router IP) as the eBGP peer address on your Colo router.
      If you're using a next-generation firewall as the Colo router, go to NetworkVirtual Routers, Add a virtual router, go to BGPPeer Group, and enter the Colo CPE IP as the Peer Address and the Cloud Router IP as the Local Address.
    8. Configure the Cloud Router BGP ASN as the eBGP peer Autonomous System Number (ASN).
      If you're using a next-generation firewall as the Colo router, go to NetworkVirtual Routers, Add a virtual router, go to BGPPeer Group, Add a peer group, and select a Peer AS of 16500.
    9. Create a BGP export policy that allows only the local GRE IP address to be advertised to the cloud router peer IP address.
      Because cloud routers can receive only a limited number of routes, you need to create policies so that only the routing between the IP addresses for the service connection GRE tunnels is sent to the cloud router.
      If you're using a next-generation firewall as the Colo router, go to NetworkVirtual Routers, Add a virtual router, go to BGPExport, Add an export rule, Match the IP addresses used as the peer IP address, and create an Action of Allow.
    10. Create the Colo-Connect service connections.

    Create Colo-Connect Service Connections

    Colo-Connect uses service connections, but they differ from Prisma Access in that they use GRE tunnels instead of IPSec tunnels and always use BGP for routing. To configure Colo-Connect service connections, complete the following steps.
    1. Make sure that Prisma Access withdraws static routes by going to WorkflowsPrisma Access SetupService ConnectionsAdvanced Settings, and selecting Withdraw Static Routes if Service Connection or Remote Network IPSec tunnel is down.
      Selecting this choice ensures that, if the GRE tunnel is down, the static route used by the GRE tunnel is withdrawn.
    2. Go to the WorkflowsPrisma Access SetupColo-ConnectConnections tab and make sure that the connections are in an Active state by checking their Status.
      Until the Status of the connection is Active, you can't configure service connections.
    3. Go to ManageConfigurationNGFW and Prisma Access and set the configuration scope to Prisma Access.
    4. Refresh the Prisma Access Sync Status so that the Colo-Connect configuration is provisioned in the service connections area.
    5. Go to WorkflowsPrisma Access SetupService ConnectionAdd Service Connection, give it a unique Name, and select a Transport Type of Colo-Connect.
      Make sure that the name you enter is 31 characters long or less; entering a name 32 characters or longer causes the tunnel to be mapped incorrectly in the Prisma Access infrastructure.
    6. Select two connections to use with the service connections (Connection 1 and Connection 2).
      These connections must be in two different zones.
    7. Select Active or Backup for Connection 1 and Connection 2
      Use these guidelines when setting up service connections:
      • You can configure connections in these modes:
        • Active/Active
        • Active/Backup
        • Backup/Active
        Configuring both connections in Backup/Backup mode is invalid and not supported.
      • The bandwidth of the connections must be the same for all modes.
      • The connections must be in different zones.
      • The maximum bandwidth you can specify for a service connection is 20 Gbps. If you specify a Bandwidth of 20 Gbps for a connection, you can't use that connection in a Active/Active configuration (it must be set as Active/Backup).
      • Don't mix dedicated and partner interconnects in the same service connection, and make sure that the service connections use different zones. This table shows the allowed and disallowed configurations for service connections, assuming that zones, locations, bandwidth, and roles follow the service connection guidelines and requirements:
        Connection 1 Belongs ToConnection 2 Belongs To Valid Colo-Connect Service Connection Configuration?
        Partner Connect 1Partner Connect 2Yes
        Dedicated Connect 1Dedicated Connect 2Yes
        Partner Connect 1Partner Connect 1No
        Dedicated Connect 1Dedicated Connect 1No
        Partner ConnectDedicated ConnectNo
    8. (Optional and for hot potato routing deployments only) Select a service connection to use as the preferred backup, which is the Backup SC, in the hot potato routing configuration.
      You can only select a service connection that has been configured as a Colo-Connect service connection. Prisma Access uses the Backup SC you select as the preferred service connection in the event of a connection failure. Selecting a backup service connection can prevent asymmetric routing issues if you have created more than two service connections.
    9. (Optional) Enable Source NAT for Mobile Users—GlobalProtect IP pool addresses, IP addresses in the Infrastructure subnet, or both.
      You can specify a subnet at one or more service connections that are used to NAT traffic between Prisma Access GlobalProtect mobile users and private applications and resources at a data center.
      • Enable Data Traffic Source NAT—Performs NAT on Mobile User IP address pool addresses so that they are not advertised to the data center, and only the subnets you specify at the service connections are advertised and routed in the data center.
      • Enable Infrastructure Traffic Source NAT—Performs NAT on addresses from the Infrastructure subnet so that they are not advertised to the data center, and only those subnets you specify at the service connections are advertised and routed in the data center.
      • IP Pool—Specify the IP address pool used to perform NAT on the mobile user IP address pool, Infrastructure subnet, or both. Use a private IP (RFC 1918) subnet or a suitable subnet that’s routable in your routing domain, and does not overlap with the Mobile Users—GlobalProtect IP address pool or the Infrastructure subnet. Enter a subnet between /25 and /32.
    10. In the GRE and BGP area, configure the GRE tunnel and BGP settings for the service connection.
      BGP is always set to Enable.
      1. (Optional) Select from the following choices:
        • To add a no-export community for Corporate Access Nodes (Service Connections) to the outbound prefixes from the eBGP peers at the customer premises equipment (CPE), set Add no-export community to Enabled Out. This capability is Disabled by default.
          Don't use this capability in hot potato routing mode.
        • To reduce the number of mobile user IP subnet advertisements over BGP to your customer premises equipment (CPE), select Summarize Mobile User Routes before advertising.
          By default, Prisma Access advertises the mobile users IP address pools in blocks of /24 subnets; if you summarize them, Prisma Access advertises the pool based on the subnet you specified. For example, Prisma Access advertises a public user mobile IP pool of 10.8.0.0/20 using the /20 subnet, rather than dividing the pool into subnets of 10.8.1.0/24, 10.8.2.0/24, 10.8.3.0/24, and so on, before advertising them. Summarizing these advertisements can reduce the number of routes stored in CPE routing tables. For example, you can use IP pool summarization with cloud VPN gateways (Virtual Private Gateways (VGWs) or Transit Gateways (TGWs)) that can accept a limited number of routes.
          If you have hot potato routing enabled and you enable route summarization, Prisma Access no longer prepends AS-PATHs, which might cause asymmetric routing. Be sure that your return traffic from the data center or headquarters location has guaranteed symmetric return before you enable route summarization with hot potato routing.
        • To prevent the Prisma Access BGP peer from forwarding routes into your organization’s network. Don’t Advertise Prisma Access Routes.
          By default, Prisma Access advertises all BGP routing information, including local routes and all prefixes it receives from other service connections, remote networks, and mobile user subnets. Select this check box to prevent Prisma Access from sending any BGP advertisements, but still use the BGP information it receives to learn routes from other BGP neighbors.
          Since Prisma Access does not send BGP advertisements if you select this option, you must configure static routes on the on-premises equipment to establish routes back to Prisma Access.
        • What is the "Route Exchange" setting?
      2. Set up routing for the service connection using GRE tunnels.
      3. From Strata Cloud Manager, return to WorkflowsPrisma Access SetupService Connection a GRE tunnel for Connection 1 by entering a GRE Tunnel Name 1 and a Peer IP 1 for Connection 1 and, if more than 10 Gbps of bandwidth is required, entering GRE Tunnel Name 2 and Peer IP 2 for the second tunnel for Connection 1; then, create a GRE tunnel for Connection 2 by repeating these same steps.
        Each pair of GRE tunnels in a connection supports a maximum of 10 Gbps of bandwidth. If you require more than 10 Gbps of bandwidth, configure two tunnels per connection. For example:
        For the Peer IP, enter the GRE IP address of the on-premises router in the Colo.
        Use IPv4 addresses for the BGP values; IPv6 isn't supported.
      4. Enter the Peer Address and the Local Address for the BGP Peer 1 and, if a second is required for Connection 1, BGP Peer 2.
        For Peer Address, enter the BGP Peer IP address of the Colo router; for Local Address, enter the address that will be used for BGP network establishment over the GRE tunnel.
      5. (Optional) To configure a BGP secret, enter the Secret and Confirm Secret values.
    11. Commit and Push your configuration changes, making sure that Colo-Connect is selected in the Push Scope.

    Set Up Routing for the Service Connection Using GRE Tunnels

    The Colo router advertises its GRE tunnel peer IP address to the cloud router, and learns the subnet for the GRE tunnel from the cloud router. When you first configured the eBGP routing over the VLAN on the customer router, you advertised local reachability for the GRE tunnels. After the cloud router and the Colo router advertise and learn the routes for the Colo subnet and the local GRE IP addresses from each other, the GRE tunnels used by the service connection become active (up).
    To set up routing and add GRE tunnels to the service connections, complete the following steps.
    1. Make a note of the IP addresses you will use for the Peer Address and the Local Address for the BGP Peer 1 and, if a second is required for Connection 1, BGP Peer 2.
      The following examples use the following peer and local addresses:
      • Peer Address—10.10.120.0 and 10.10.130.1 for Connection 1, 10.10.120.2 and 10.10.130.2 for Connection 2
      • Local Address—10.10.120.2 and 10.10.130.2 for Connection 1, 10.10.121.2 and 10.10.131.2 for Connection 2
    2. Make a note of the IP addresses you will use for the Peer IP 1 and, if required, Peer IP 2 address in the service connections.
      You use these IP addresses to create a Deny policy that prevents the local GRE IP address to be advertised to the Colo-Connect service connection.
      All examples in this document use these IP addresses:
      • 172.120.1.1 for Connection 1
      • 172.121.1.1 for Connection 2
    3. Configure Peer groups for the peer and local IP addresses.
      If you're using a next-generation firewall as the Colo router, go to NetworkVirtual Routers, Add a virtual router, go to BGPPeer Group, and enter the Peer Address as the Peer Address and the Local Address as the Local Address.
    4. Create a BGP export policy to deny the peer IP addresses you configured (172.120.1.1, 172.130.1.1, 172.121.1.1, and 172.131.1.1) and apply them to the peer groups you created.
      This export policy places a DENY rule on the local GRE tunnel peer IP addresses and allows all other routes to be advertised to the service connection.
      If you're using a next-generation firewall as the Colo router, go to NetworkVirtual Routers, Add a virtual router, go to BGPExport, Add an export rule, Match the IP addresses used as the peer IP address, and create an Action of Deny.

    Increase or Decrease the Bandwidth of a Colo-Connect Service Connections

    When you configure service connections, you configure bandwidth based on the connections (VLAN attachments) you associate with it. You allocate two connections per service connection, and then allocate either one or two GRE tunnels per connection.
    While each Colo-Connect service connection supports a maximum of 20 Gbps, each GRE tunnel in the service connection supports 10 Gbps. For this reason, you might have to add or delete the GRE tunnels in the Colo-Connect service connection change the total bandwidth in a link and it causes the service connection bandwidth to go above or below 10 Gbps.

    Increase the Bandwidth of a Colo-Connect Service Connection

    To increase the bandwidth of an existing service connection above 10 Gbps, complete the following steps:
    1. Go to WorkflowsPrisma Access SetupColo-Connect.
    2. Select the Link Name associated with the service connection.
    3. Increase the Bandwidth of the link (interconnect).
    4. Push Config.
    5. Go to WorkflowsPrisma Access SetupService Connection.
    6. Add the extra GRE tunnel to the Colo-Connect service connection.
    7. Push Config.
    8. Add the GRE local (peer) IP addresses to your export policies for the VLAN eBGP routing and service connection routing for the GRE tunnels.

    Decrease the Bandwidth of a Colo-Connect Service Connection

    To decrease the bandwidth of an existing service connection above 10 Gbps, complete the following steps:
    1. Go to WorkflowsPrisma Access SetupColo-Connect .
    2. Select the Link Name associated with the service connection.
    3. Decrease the Bandwidth of the link (interconnect).
    4. Push Config.
      You don't have to reconfigure the service connection to remove the extra GRE tunnel; Prisma Access detects and lowered bandwidth of the link and removes the extra tunnel when you commit and push your changes in the service connection push scope.

    Delete a Colo-Connect Connection

    To deleting a Colo-Connect connection, follow the reverse order of configuring it by completing the following steps:
    1. Delete the service connections associated with the connection by going to WorkflowsPrisma Access SetupService Connections, selecting the service connection, and Delete it.
    2. Push Config.
    3. Delete the Colo-Connect connections associated with the connection by going to WorkflowsPrisma Access SetupColo-Connect, selecting the Connection Name in the Onboarding section, and Delete it.
    4. Delete the Colo-Connect link by selecting the Link Name and Delete it.
    5. Delete the GRE local (peer) IP addresses to your export policies for the VLAN eBGP routing and service connection routing for the GRE tunnels.

    Configure Prisma Access Colo-Connect (Panorama)

    Configure a Colo-Connect deployment in Prisma Access.

    Configure Prisma Access Colo-Connect—Deployments Using Partner Interconnects

    To configure Prisma Access Colo-Connect using a partner interconnect, complete these steps.
    1. Create subnets for your Colo-Connect connections.
      You use the subnets you create here in the connections and service connections that you create in later steps.
      1. Go to PanoramaCloud ServicesConfigurationColo-Connect and click the gear icon to edit the settings.
      2. Add a Colo-Connect Subnet and select a Prisma Access location (PA Location) for it.
        Enter a minimum subnet of /28.
      3. (Optional) If you plan on creating Colo-Connect instances for more than one location, Add more subnets on a per-location basis.
        You can configure one subnet per location.
      4. Select Create new templates and device-group for Prisma Access Colo-Connect.
        The first time you configure a Colo-Connect deployment, select this check box so that templates and device groups (Colo_Connect_Template and Colo_Connect_Device_Group, respectively) are created for Colo-Connect. After you create these templates and device groups, this check box is grayed out.
    2. Add a new Colo-Connect link (also known as the interconnect).
      1. Go to PanoramaCloud ServicesConfigurationColo-ConnectColo Connect Link and Add a Colo-Connect link.
      2. Give the link a unique Link Name.
      3. Select a Partner interconnect.
        You do not need to enter a VLAN ID, your Colo provides one when it uses the pairing key to complete the configuration of your VLAN attachment.
      4. Specify the remaining Colo-Connect link parameters.
        • Select either 10Gbps or 20Gbps for the Bandwidth.
          You cannot change the bandwidth of a dedicated interconnect link after you specify it and commit and push your changes.
        • Select either Zone1 or Zone2 for the Edge Availability Domain. Take this value from the GCP zone used for your edge availability domain.
        • Enter the Organization Name to use for this link.
        • Enter the Email to use for this link. Any email address is acceptable.
    3. Create the connections (also known as the VLAN attachments) for Colo-Connect.
      1. Go to PanoramaCloud ServicesConfigurationColo-ConnectOnboarding and Add a new connection.
      2. Configure the connection settings.
        • Enter a unique Name for the connection.
        • Select a Link Name from the links you configured in a previous step.
        • Select a Bandwidth for the connection.
          You can select between 1 Gbps, 2 Gbps, 5 Gbps, 10 Gbps, or 20 Gbps.
          If you configure multiple connections for an interconnect, make sure that the total bandwidth of the connections does not exceed the bandwidth of the interconnect. For example, given a partner interconnect of 10 Gbps, you can configure 10 connections of 1 Gbps each, but do not exceed 10 Gbps in total for all connections.
          If your deployment requires more than 16 connections, reach out to your Palo Alto Networks account team, who will open an SRE case to accommodate the request.
        • Enter a BGP Peer ASN.
          Enter the Autonomous System (AS) number for the customer on-premises router in the Colo. The range is between 1 and 4294967295.
        • Select the Location from the connection names you created in a previous step.
          You must have already added a subnet for any location you specify.
        • (Optional) Enter the BGP MD5 Secret.
          Disregard the BGP BFD field; it is reserved for a future Colo-Connect release.
      3. Continue to create connections until complete.
        You must create two connections. Both connections must be in the same region and one connection each must be in a separate zone. You use these connections in service connections you create in a later step.
    4. Commit and push your changes.
      1. Go to CommitCommit and Push.
      2. Edit Selections and make sure that Colo-Connect is selected in the push scope.
      3. Click OK to save your changes to the Push Scope.
      4. Commit and Push your changes.
    5. Retrieve the Pairing Key and complete your partner interconnect configuration in GCP.
      You use this pairing key when you set up the partner interconnect in the Colo.
      When you first onboard a new connection, the Status in the Colo-Connect Onboarding area shows a Status of PENDING_PARTNER and a BGP Status of DOWN. To bring the connection status to ACTIVE, retrieve the Pairing Key and input in the connection at the Colo.
      1. Go to PanoramaCloud ServicesStatusNetwork DetailsColo Connect and copy the Pairing Key.
      2. Create a new VLAN connection in the Colo (for example, Equinix).
      3. Paste the Pairing Key in the Colo VLAN.
        GCP detects when the pairing key is consumed, brings the VLAN status to ACTIVE, and generates the BGP IP address for you to configure on your on-premises router in the Colo. These actions initiate eBGP routing over the VLAN between the Colo router and the GCP cloud router.
    6. Create eBGP routing on the Customer (Colo) router for the Colo-Connect connection.
      You need to set up BGP peering to ensure connectivity between the customer router. and the cloud router.
    7. Set up the service connections to use with Colo-Connect.
    8. Commit and Push your configuration changes, making sure that Colo-Connect is selected in the Push Scope.
    9. Check the status of the Colo-Connect connections.
      1. To check the status of a service connection used by a Colo-Connect connection, go to PanoramaCloud ServicesStatusColo ConnectMonitor
      2. Hover over a region that has a Colo-Connect connection deployed.
        • If the Colo-Connect connection and the BGP routing are both up, the Status displays OK.
        • If the Colo-Connect connection is up but BGP routing is not up, the Status displays Warning.
        • If the Colo-Connect connection and BGP routing are down, the Status displays Down.
        • If the Colo-Connect connection is down but BGP routing is up, the Status displays Error.
      3. For more information, click the region box and view the information in the Status tab.
    10. Check the network details, including the Pairing Key, of the Colo-Connect connections by going to PanoramaCloud ServicesStatusNetwork DetailsColo Connect and viewing the information in the following fields.

    Configure Prisma Access Colo-Connect—Deployments Using Dedicated Interconnects

    To configure Prisma Access Colo-Connect using a dedicated interconnect, complete these steps.
    1. Create subnets for your Colo-Connect connections.
      You use the subnets you create here in the connections and service connections that you create in later steps.
      1. From the Panorama that manages Prisma Access, go to PanoramaCloud ServicesConfigurationColo-Connect and click the gear icon to edit the settings.
      2. Add a Colo-Connect Subnet and select a Prisma Access location (PA Location) for it.
        Enter a minimum subnet of /28.
      3. (Optional) If you plan on creating Colo-Connect instances for more than one location, Add more subnets on a per-location basis.
        You can configure only one subnet per location.
      4. Select Create new templates and device-group for Prisma Access Colo-Connect.
        The first time you configure a Colo-Connect deployment, select this check box so that templates and device groups (Colo_Connect_Template and Colo_Connect_Device_Group, respectively) are created for Colo-Connect. After you create these templates and device groups, this check box is grayed out.
    2. Add a new Colo-Connect link (also known as the interconnect).
      1. Go to PanoramaCloud ServicesConfigurationColo-ConnectColo Connect Link and Add a Colo-Connect link.
      2. Give the link a unique Link Name.
      3. Select a Dedicated interconnect.
      4. Specify the remaining Colo-Connect link parameters.
        • Select either 10Gbps or 20Gbps for the Bandwidth.
          If you select 20 Gbps, you must aggregate the Dedicated Interconnect link into two 10 Gbps links using LACP.
          You cannot change the bandwidth of a dedicated interconnect link after you specify it and commit and push your changes.
        • Select a Colo-Connect Location from the drop-down list.
          Make sure that you select the same location that you used for the dedicated interconnect.
        • Select either Zone1 or Zone2 for the Edge Availability Domain. Take this value from the GCP zone used for your edge availability domain.
        • Enter the Organization Name to use for this link.
        • Enter the Email where you want to receive the LOA-CFA details from the cloud provider.
    3. After the dedicated connection is created, the Colo facility tests your connections and informs you that they have been tested and are ready to use.
      No Prisma Access configuration is required for this step. Do not create the Colo-Connect connections in Prisma Access until the Colo facility lets you know that they have been tested.
    4. Create the connections (also known as the VLAN attachments) for Colo-Connect.
      1. Make sure that the dedicated link status is Active by going to PanoramaCloud ServicesConfigurationColo-ConnectColo Connect Link.
        Until the Dedicated link status is Active, you cannot create Colo-Connect links.
      2. Go to PanoramaCloud ServicesConfigurationColo-ConnectOnboarding and Add a new connection.
      3. Configure the connection settings.
        • Enter a unique Name for the connection.
        • Select a Link Name from the links you configured in a previous step.
        • (Optional) Enter a VLAN ID for the connection.
          VLAN IDs are generated by the interconnect vendor (GCP) if you do not manually enter a value.
        • Select a Bandwidth for the connection.
          You can select between 1 Gbps, 2 Gbps, 5 Gbps, 10 Gbps, or 20 Gbps.
          If you configure multiple connections for an interconnect, make sure that the total bandwidth of the connections does not exceed the bandwidth of the interconnect. For example, given a dedicated interconnect of 20 Gbps, you can configure 10 connections of 2 Gbps each, but do not exceed 20 Gbps in total for all connections.
        • Enter a BGP Peer ASN.
          Enter the Autonomous System (AS) number for the customer on-premises router in the Colo. The range is between 1 and 4294967295.
        • Select the Location from the connection names you created in a previous step.
          You must have already added a subnet for any location you specify.
        • (Optional) Enter the BGP MD5 Secret.
      4. Continue to create connections until complete.
        You must create two connections. Both connections must be in the same region and one connection each must be in a separate zone. You use these connections in service connections you create in a later step.
    5. Commit and push your changes.
      1. Go to CommitCommit and Push.
      2. Edit Selections and make sure that Colo-Connect is selected in the push scope.
      3. Click OK to save your changes to the Push Scope.
      4. Commit and Push your changes.
    6. Configure eBGP routing on the customer router.
      You need to set up BGP peering to ensure connectivity between the customer router,
    7. Set up the service connections to use with Colo-Connect.
    8. Commit and Push your configuration changes, making sure that Colo-Connect is selected in the Push Scope.
    9. Check the status of the Colo-Connect connections.
      1. To check the status of a service connection used by a Colo-Connect connection, go to PanoramaCloud ServicesStatusColo ConnectMonitor.
      2. Hover over a region that has a Colo-Connect connection deployed.
        • If the Colo-Connect connection and the BGP routing are both up, the Status displays OK.
        • If the Colo-Connect connection is up but BGP routing is not up, the Status displays Warning.
        • If the Colo-Connect connection and BGP routing are down, the Status displays Down.
        • If the Colo-Connect connection is down but BGP routing is up, the Status displays Error.
      3. For more information, click the region box and view the information in the Status tab.
    10. Check the network details of the Colo-Connect connections by going to PanoramaCloud ServicesStatusNetwork DetailsColo Connect and viewing the details.
      For dedicated links, the Pairing Key displays as N/A.

    Configure VLAN eBGP Routing On the Customer Router

    GCP creates IP addresses for the customer (Colo) router and the cloud router during these stages of your deployment:
    • For partner interconnects, GCP creates the IP addresses after the pairing key is consumed by your Colo (for example, Equinix).
    • For dedicated interconnects, GCP creates the IP addresses after you onboard your Colo-Connect connections (VLAN attachments) and commit and push your changes.
    To ensure correct routing, you must:
    • Configure the Colo router IP address (the Colo CPE IP in the Prisma Access UI) as the local VLAN IP address and the local eBGP IP address
    • Configure the cloud router IP address (Cloud Router IP) as the eBGP peer address on your Colo router.
    When complete, eBGP is configured for the connection (VLAN attachment) between the Colo router and the cloud router.
    Creating this routing is the first step in setting up GRE tunnel routing. You complete the GRE tunnel routing when you set up GRE tunnels during service connection configuration.
    Use the following steps to configure routing between the Colo and the cloud router.
    1. From the Panorama that manages Prisma Access, create the subnets, links, and connections and Commit and Push your changes.
      Use the workflow specific to your interconnect type (either Partner or Dedicated) For Partner interconnects, be sure that you pasted the Pairing Key into the Colo VLAN.
    2. Go to PanoramaCloud ServicesStatusNetwork DetailsColo Connect.
    3. Make a note of the following connection elements:
      • Colo CPE IP
      • Cloud Router IP
      • Cloud Router BGP ASN
      In the following example:
      • For the vlan-central-1 connection, the Colo CPE IP is 169.254.24.170/29, the Cloud Router IP is 169.254.24.169/29, and the Cloud Router BGP ASN is 16550
      • For the vlan-central-2 connection, the Colo CPE IP is 169.254.120.74/29, the Cloud Router IP is 169.254.120.73/29, and the Cloud Router BGP ASN is 16550.
      • .
    4. Determine the IP addresses you will use for the local GRE IP addresses when you set up the Colo-Connect service connections.
      You configure these when you set up a Colo-Connect service connection (PanoramaCloud ServicesConfigurationService Connection). in the Peer IP 1 and Peer IP 2 areas.
      If you are configuring a service connection to support up to 10 Gbps of throughput, put one tunnel each in Connection 1 and Connection 2, for a total of two tunnels in each service connection.
      If you are configuring a service connection to support more than 10 Gbps of throughput (up to 20 Gbps), put two tunnels each in Connection 1 and Connection 2, for a total of four tunnels in each service connection.
      The following examples show a tunnel being configured for more than 10 Gbps throughput, so two tunnels per connection are used, and they use the following peer IP addresses:
      • 172.120.1.1 for Connection 1
      • 172.130.1.1 for Connection 1
      • 172.121.1.1 for Connection 2
      • 172.131.1.1 for Connection 2
    5. Log in to the Colo router.
      The following configuration screenshots use a Palo Alto Networks next-generation firewall as the Colo router.
    6. Add a VLAN interface, specifying the Colo CPE IP address as the IP address.
      If you are using a next-generation firewall as the Colo router, go to NetworkInterfacesVLAN and Add the VLAN interface, specifying the Virtual Router name, and
    7. Configure the Colo router IP address (Colo CPE IP) as the local eBGP IP address and Configure the cloud router IP address (Cloud Router IP) as the eBGP peer address on your Colo router.
      If you are using a next-generation firewall as the Colo router, go to NetworkVirtual Routers, Add a virtual router, go to BGPPeer Group, and enter the Colo CPE IP as the Peer Address and the Cloud Router IP as the Local Address.
    8. Configure the Cloud Router BGP ASN as the eBGP peer Autonomous System Number (ASN).
      If you are using a next-generation firewall as the Colo router, go to NetworkVirtual Routers, Add a virtual router, go to BGPPeer Group, Add a peer group, and select a Peer AS of 16500.
    9. Create a BGP export policy that allows only the local GRE IP address to be advertised to the cloud router peer IP address.
      Because cloud routers can receive only a limited number of routes, you need to create policies so that only the routing between the IP addresses for the service connection GRE tunnels are sent to the cloud router.
      If you are using a next-generation firewall as the Colo router, go to NetworkVirtual Routers, Add a virtual router, go to BGPExport, Add an export rule, Match the IP addresses used as the peer IP address, and create an Action of Allow.
    10. Create the Colo-Connect service connections.

    Create Colo-Connect Service Connections

    Colo-Connect uses service connections, but they differ from Prisma Access in that they use GRE tunnels instead of IPSec tunnels and always use BGP for routing. To configure Colo-Connect service connections, complete the following steps.
    1. From the Panorama that manages Prisma Access, make sure that Prisma Access withdraws static routes by going to PanoramaCloud ServicesConfigurationService Setup, clicking the gear icon to edit the Settings, and selecting Withdraw Static Routes if Service Connection or Remote Network IPSec tunnel is down.
      Selecting this choice ensures that, if GRE tunnel is down, the static route used by the GRE tunnel is withdrawn.
    2. Go to the Colo-Connect tab and make sure that the connections are in an Active state by checking the Status field in the Onboarding area.
      Until the Status of the connection is Active, you cannot configure service connections.
    3. Go to PanoramaCloud ServicesConfigurationService Connection.
    4. Click Refresh on the top right of the Panorama UI so that the Colo-Connect configuration is provisioned in the service connections area.
    5. Add a service connection, give it a unique Name, and select a Transport Type of Colo-Connect.
      Make sure that the name you enter is 31 characters long or less; entering a name 32 characters or longer causes the tunnel to be mapped incorrectly in the Prisma Access infrastructure.
    6. Select two connections to use with the service connections (Connection 1 and Connection 2).
      These connections must be in two different zones.
    7. Select Active or Backup for Connection 1 and Connection 2
      Use these guidelines when setting up service connections:
      • You can configure connections in these modes:
        • Active/Active
        • Active/Backup
        • Backup/Active
        Configuring both connections in Backup/Backup mode is invalid and not supported.
      • The bandwidth of the connections must be the same for all modes.
      • The connections must be in different zones.
      • The maximum bandwidth you can specify for a service connection is 20 Gbps. If you specify a Bandwidth of 20 Gbps for a connection, you cannot use that connection in a Active/Active configuration (it must be set as Active/Backup).
      • Do not mix dedicated and partner interconnects in the same service connection, and make sure that the service connections use different zones. This table shows the allowed and disallowed configurations for service connections, assuming that zones, locations, bandwidth, and roles follow the service connection guidelines and requirements:
        Connection 1 Belongs ToConnection 2 Belongs To Valid Colo-Connect Service Connection Configuration?
        Partner Connect 1Partner Connect 2Yes
        Dedicated Connect 1Dedicated Connect 2Yes
        Partner Connect 1Partner Connect 1No
        Dedicated Connect 1Dedicated Connect 1No
        Partner ConnectDedicated ConnectNo
    8. (Optional, Hot Potato Routing Deployments Only) Select a service connection to use as the preferred backup (Backup SC).
      You can only select a service connection that has been configured as Colo-Connect service connection. Prisma Access uses the Backup SC you select as the preferred service connection in the event of a connection failure. Selecting a backup service connection can prevent asymmetric routing issues if you have created more than two service connections.
    9. (Optional) Enable Source NAT for Mobile Users—GlobalProtect IP pool addresses, IP addresses in the Infrastructure Subnet, or both.
      You can specify a subnet at one or more service connections that are used to NAT traffic between Prisma Access GlobalProtect mobile users and private applications and resources at a data center.
      • Enable Data Traffic Source NAT—Performs NAT on Mobile User IP address pool addresses so that they are not advertised to the data center, and only the subnets you specify at the service connections are advertised and routed in the data center.
      • Enable Infrastructure Traffic Source NAT—Performs NAT on addresses from the Infrastructure Subnet so that they are not advertised to the data center, and only those subnets you specify at the service connections are advertised and routed in the data center.
      • IP Pool—Specify the IP address pool used to perform NAT on the mobile user IP address pool, Infrastructure Subnet, or both. Use a private IP (RFC 1918) subnet or a suitable subnet that is routable in your routing domain, and does not overlap with the Mobile Users—GlobalProtect IP address pool or the Infrastructure Subnet. Enter a subnet between /25 and /32.
    10. In the GRE and BGP area, configure the GRE tunnel and BGP settings for the service connection.
      BGP is always set to Enable.
      1. (Optional) Select from the following choices:
        • To add a no-export community for Corporate Access Nodes (Service Connections) to the outbound prefixes from the eBGP peers at the customer premises equipment (CPE), set Add no-export community to Enabled Out. This capability is Disabled by default.
          Do not use this capability in hot potato routing mode.
        • To prevent the Prisma Access BGP peer from forwarding routes into your organization’s network. Don’t Advertise Prisma Access Routes.
          By default, Prisma Access advertises all BGP routing information, including local routes and all prefixes it receives from other service connections, remote networks, and mobile user subnets. Select this check box to prevent Prisma Access from sending any BGP advertisements, but still use the BGP information it receives to learn routes from other BGP neighbors.
          Since Prisma Access does not send BGP advertisements if you select this option, you must configure static routes on the on-premises equipment to establish routes back to Prisma Access.
        • To reduce the number of mobile user IP subnet advertisements over BGP to your customer premises equipment (CPE), select Summarize Mobile User Routes before advertising.
          By default, Prisma Access advertises the mobile users IP address pools in blocks of /24 subnets; if you summarize them, Prisma Access advertises the pool based on the subnet you specified. For example, Prisma Access advertises a public user mobile IP pool of 10.8.0.0/20 using the /20 subnet, rather than dividing the pool into subnets of 10.8.1.0/24, 10.8.2.0/24, 10.8.3.0/24, and so on before advertising them. Summarizing these advertisements can reduce the number of routes stored in CPE routing tables. For example, you can use IP pool summarization with cloud VPN gateways (Virtual Private Gateways (VGWs) or Transit Gateways (TGWs)) that can accept a limited number of routes.
          If you have hot potato routing enabled and you enable route summarization, Prisma Access no longer prepends AS-PATHs, which might cause asymmetric routing. Be sure that your return traffic from the data center or headquarters location has guaranteed symmetric return before you enable route summarization with hot potato routing.
      2. Set up routing for the service connection using GRE tunnels.
      3. From the Panorama that manages Prisma Access, return to PanoramaCloud ServiceConfigurationService Connection a GRE tunnel for Connection 1 by entering a GRE Tunnel Name 1 and a Peer IP 1 for Connection 1 and, if more than 10 Gbps of bandwidth is required, entering GRE Tunnel Name 2 and Peer IP 2 for the second tunnel for Connection 1; then, create a GRE tunnel for Connection 2 by repeating these same steps.
        Each pair of GRE tunnels in a connection supports a maximum of 10 Gbps of bandwidth. If you require more than 10 Gbps of bandwidth, configure two tunnels per connection. For example:
        For the Peer IP, enter the GRE IP address of the on-premises router in the Colo.
        Use IPv4 addresses for the BGP values; IPv6 is not supported.
      4. Enter the Peer Address and the Local Address for the BGP Peer 1 and, if a second tunnel was required for Connection 1, BGP Peer 2.
        For Peer Address, enter the BGP Peer IP address of the Colo router; for Local Address, enter the address that will be used for BGP network establishment over the GRE tunnel.
      5. (Optional) To configure a BGP secret, enter the Secret and Confirm Secret values.
    11. Commit and Push your configuration changes, making sure that Colo-Connect is selected in the Push Scope.

    Set Up Routing for the Service Connection Using GRE Tunnels

    The Colo router advertises its GRE tunnel peer IP address to the cloud router, and learns the subnet for the GRE tunnel from the cloud router. When you first configured the eBGP routing over the VLAN on the customer router, you advertised local reachability for the GRE tunnels. After the cloud router and the Colo router advertise and learn the routes for the Colo subnet and the local GRE IP addresses from each other, the GRE tunnels used by the service connection become active (up).
    To set up routing and add GRE tunnels to the service connections, complete the following steps.
    1. Make a note of the IP addresses you will use for the Peer Address and the Local Address for the BGP Peer 1 and, if a second tunnel was required for Connection 1, BGP Peer 2.
      The following examples use the following peer and local addresses:
      • Peer Address—10.10.120.0 and 10.10.130.1 for Connection 1, 10.10.120.2 and 10.10.130.2 for Connection 2
      • Local Address—10.10.120.2 and 10.10.130.2 for Connection 1, 10.10.121.2 and 10.10.131.2 for Connection 2
    2. Make a note of the IP addresses you will use for the Peer IP 1 and, if required, Peer IP 2 address in the service connections.
      You use these IP addresses to create a Deny policy that prevents the local GRE IP address to be advertised to the Colo-Connect service connection.
      All examples in this document use these IP addresses:
      • 172.120.1.1 for Connection 1
      • 172.130.1.1 for Connection 1
      • 172.121.1.1 for Connection 2
      • 172.131.1.1 for Connection 2
    3. Configure Peer groups for the peer and local IP addresses.
      If you are using a next-generation firewall as the Colo router, go to NetworkVirtual Routers, Add a virtual router, go to BGPPeer Group, and enter the Peer Address as the Peer Address and the Local Address as the Local Address.
    4. Create a BGP export policy to deny the peer IP addresses you configured (172.120.1.1, 172.130.1.1, 172.121.1.1, and 172.131.1.1) and apply them to the peer groups you created.
      This export policy places a DENY rule on the local GRE tunnel peer IP addresses and allows all other routes to be advertised to the service connection.
      If you are using a next-generation firewall as the Colo router, go to NetworkVirtual Routers, Add a virtual router, go to BGPExport, Add an export rule, Match the IP addresses used as the peer IP address, and create an Action of Deny.

    Increase or Decrease the Bandwidth of a Colo-Connect Service Connections

    When you configure service connections, you configure bandwidth based on the connections (VLAN attachments) you associate with it. You allocate two connections per service connection, and then allocate either one or two GRE tunnels per connection.
    While each Colo-Connect service connection supports a maximum of 20 Gbps, each GRE tunnel in the service connection supports 10 Gbps. For this reason, you might have to add or delete the GRE tunnels in the Colo-Connect service connection change the total bandwidth in a link and it causes the service connection bandwidth to go above or below 10 Gbps.

    Increase the Bandwidth of a Colo-Connect Service Connection

    To increase the bandwidth of an existing service connection above 10 Gbps, complete the following steps:
    1. Go to PanoramaCloud ServicesConfigurationColo-Connect.
    2. Go to PanoramaCloud ServicesConfigurationService Connection and click Refresh on the top right of the Panorama UI so that the Colo-Connect configuration is provisioned in the service connections area.
    3. Select the Link Name associated with the service connection.
    4. Increase the Bandwidth of the link (interconnect).
    5. Commit and Push your changes, selecting only Colo-Connect in the Push Scope.
    6. Go to PanoramaCloud ServicesConfigurationService Connection<service-connection-name>Onboarding.
    7. Add the extra GRE tunnel to the Colo-Connect service connection.
    8. Commit and Push your changes, selecting Service Connections in the Push Scope.
    9. Add the GRE local (peer) IP addresses to your export policies for the VLAN eBGP routing and service connection routing for the GRE tunnels.

    Decrease the Bandwidth of a Colo-Connect Service Connection

    To decrease the bandwidth of an existing service connection above 10 Gbps, complete the following steps:
    1. Go to PanoramaCloud ServicesConfigurationColo-Connect
    2. Go to PanoramaCloud ServicesConfigurationService Connection and click Refresh on the top right of the Panorama UI so that the Colo-Connect configuration is provisioned in the service connections area.
    3. Select the Link Name associated with the service connection.
    4. Decrease the Bandwidth of the link (interconnect).
    5. Commit and Push your changes, selecting only Colo-Connect in the Push Scope.
    6. Commit and Push your changes, selecting Service Connections in the Push Scope.
      You do not have to reconfigure the service connection to remove the extra GRE tunnel; Prisma Access detects and lowered bandwidth of the link and removes the extra tunnel when you commit and push your changes in the service connection push scope.

    Delete a Colo-Connect Connection

    To deleting a Colo-Connect connection, follow the reverse order of configuring it by completing the following steps:
    1. Delete the service connections associated with the connection by going to PanoramaCloud ServicesConfigurationService Connection, selecting the service connection, and Delete it.
    2. Commit and Push your changes, selecting Service Connections in the Push Scope.
    3. Delete the Colo-Connect connections associated with the connection by going to PanoramaCloud ServicesConfigurationColo-Connect, selecting the Connection Name in the Onboarding section, and Delete it.
    4. Delete the Colo-Connect link by selecting the Link Name and Delete it.
    5. Delete the GRE local (peer) IP addresses to your export policies for the VLAN eBGP routing and service connection routing for the GRE tunnels.

    © 2024 Palo Alto Networks, Inc. All rights reserved.