Use Service Endpoint Groups in Policies
Learn more about the use of service endpoint groups in
policies.
| Where Can I Use
This? | What Do I Need? |
|---|
You must define service endpoint groups
before using a standard VPN in a policy rule. Each group can have
one or more
Prisma SD-WAN data centers or standard service endpoints.
A group is used in policy rules. You must
bind domain to sites to
define mappings for endpoints to
groups groups.
This ensures the policy rules using the group is effective.
If you choose standard VPN as a path to allow traffic to transit
through a standard endpoint, you must have a standard service and
DC group defined with the appropriate endpoints associated.
There can be four combinations of active or backup
groups that can be used in policies. You can select only one Palo
Alto Networks group or one non-Palo Alto Networks group as an active
or backup path in policies. The following table explains the combinations
of the active or backup groups in policies.
| Active Group | Backup Group | Example |
|---|
| Standard | Palo Alto Networks | Internet-bound SSL traffic from a branch site
transits through the Cloud Security Service. If all standard VPN paths
to any of the endpoints are not available, internet-bound SSL traffic transits
through one of the Prisma SD-WAN data center endpoints assigned
to that group using the Palo Alto Networks VPN. |
| Palo Alto Networks | Standard | Internet-bound SSL traffic from a branch site
transits through one of the Prisma SD-WAN data center endpoints
assigned to that group using the Palo Alto Networks VPNs. If all
Palo Alto Networks VPNs to all of the data center endpoints in that group
are unavailable, internet-bound SSL traffic transits through the
Cloud Security Service using one of the standard VPN paths to any
of the endpoints in the standard group. |
| Standard | Standard | Internet-bound SSL traffic from a branch site
transits through the primary Cloud Security Service using one of
the standard VPN paths to any of the endpoints in the primary Cloud Security
Service group. If all standard VPNs are down to all endpoints in
the primary group, the internet-bound SSL traffic transits through
the backup Cloud Security Service using one of the standard VPN
paths to the endpoints that are part of the backup group. |
| Palo Alto Networks | Palo Alto Networks | Internet-bound SSL traffic from a branch site
transits through one of the Prisma SD-WAN data center endpoints
assigned to the active group using the Palo Alto Networks VPNs.
If all Palo Alto Networks VPNs to all of those endpoints are down, internet-bound
SSL traffic transits through one of the Prisma SD-WAN data center
endpoints assigned to the backup group using the Palo Alto Networks
VPNs. |
