>
    Strata Copilot
    Strata Cloud Manager
    Focus
    Download PDF
    Focus
    1. Home
    2. SD-WAN
    3. SD-WAN Deployment Workflow
    4. Strata Cloud Manager
    Download PDF
    SD-WAN

    Strata Cloud Manager

    Table of Contents

    Strata Cloud Manager

    Set up and configure SD-WAN on Strata Cloud Manager for Palo Alto Networks Next-Generation Firewalls.
    Contact your account team to enable Cloud Management for NGFWs using Strata Cloud Manager.

    Set Up SD-WAN

    Set up a Software-Defined Wide Area Network (SD-WAN) on Strata Cloud Manager for your Palo Alto Networks Next-Gen Firewalls (NGFW).
    1. Log in to Strata Cloud Manager.
    2. Onboard your SD-WAN firewalls to Strata Cloud Manager.
      All newly added firewalls are added the All Firewalls folder by default.
    3. Activate the SD-WAN license on your firewall.
    4. Create the SD-WAN folders for hub and branch firewalls.
      Separate folders for your hub and branch firewalls are required to containing all SD-WAN configuration objects specific to hub and branch firewall deployments.
      1. Select System SettingsFolder Management and Add Folder.
        Add new folders for your hub and branch SD-WAN firewalls.
      2. In Folder Management, locate your hub and branch firewalls and expand the Actions menu to Move your firewalls.
        For the Destination, select the hub or branch folder you created and Move.
    5. Create zone-internal, zone-to-branch, and zone-to-hub security zones (case sensitive). The SD-WAN plugin will create these zones, but the best practice is to preprovision these zones so they can be added to existing Security policy rules (prior to SD-WAN transition). Every transport or interface participating in SD-WAN needs to be in the same security zone.
    6. Create link tags.
      Create a link tag to identify one or more physical links that you want applications and services to use in a specific ordering during SD-WAN traffic distribution and failover protection. Grouping multiple physical links allows you to maximize the application service quality if the physical link health deteriorates.
      1. Select ConfigurationNGFW and Prisma AccessNetwork PoliciesSD-WAN PolicyLink Tags and create your link tags at the All Firewalls Context Scope.
        Palo Alto Networks recommends creating all link tags at the All Firewalls folder level to ensure link tags are available to all SD-WAN firewalls regardless of the folder they’re associated with.
      2. Add Tag.
      3. Enter a Name and select a Color to identify the link tag.
      4. Save.

    Configure SD-WAN

    Contact your account team to enable Cloud Management for NGFWs using Strata Cloud Manager.
    Configure the physical Ethernet interfaces and SD-WAN interface profile to enable SD-WAN functionality and define the characteristics of the ISP connections the firewall monitors. Additionally, you must create the SD-WAN VPN cluster to determine which branches communicate with which hubs and to create a secure connection between the branch and hub firewalls.
    1. Log in to Strata Cloud Manager.
    2. Set up SD-WAN.
    3. Configure a layer 3 interface.
      Layer 3 interfaces are required for SD-WAN functionality. Repeat this step to configure as many Layer 3 Ethernet interfaces on your SD-WAN firewall as needed.
      You can configure up to four IP addresses for an SD-WAN enabled interface. The Auto VPN workflows uses only the first IP address from the configured IPv4 address list to create the VPN tunnel and ignores the remaining IPv4 addresses in the list.
    4. Configure a logical router and add the interfaces that you created in the previous step to the logical router.
    5. (Optional) Configure a BGP redistribution profile.
    6. Configure an SD-WAN interface profile.
      The SD-WAN interface profile defines the characteristics of the ISP connection, specifies the speed of links and how frequently the firewall monitors the link, and specifies the link tag. When you specify the same Link Tag on multiple links, you’re grouping (bundling) those physical links into a link bundle or fat pipe.
      1. Select ConfigurationNGFW and Prisma AccessNetwork PoliciesSD-WAN PolicyProfilesSD-WAN Interface and select the hub or branch folder where want to create the SD-WAN interface profile.
      2. Add Profile.
      3. Enter a descriptive Name for the profile.
      4. Select the Link Tag the profile assigns to the interface.
      5. Select the Link Type from the predefined list.
      6. Specify the Maximum Download (Mbps) speed from the ISP.
      7. Specify the Maximum Upload (Mbps) speed to the ISP.
      8. Check (enable Eligible for Error Correction Profile Interface Selection to enable Forward Error Correction (FEC) or packet duplication for interfaces.
        If enabled, you must enable this setting for both sending and receiving firewalls.
      9. VPN Data Tunnel Support determines whether the branch-to-hub traffic and return traffic flows through a VPN tunnel for added security or flows outside of the VPN tunnel to avoid encryption overhead. This setting is enabled by default.
        • Keep enabled for public links that have direct internet connections or internet break capabilities, such as cable modem, ADSL, and other internet connections.
        • Disable for private link types such as MPLS, satellite, or microwave that doesn’t have internet breakout capability. However, you must first ensure that the traffic can’t be intercepted because it will be sent outside of the VPN tunnel.
        • The branch might have DIA traffic that needs to fail over to the private MPLS link connecting to the hub, and reach the internet from the hub. The VPN Data Tunnel Support setting determines whether the private data flows through the VPN tunnel or flows outside the tunnel, and the failed over traffic uses the other connection (that the private data flow doesn’t use). The firewall uses zones to segment DIA failover traffic from private MPLS traffic.
      10. Set the VPN Failover Metric if DIA AnyPath is enabled a hub or branch firewall, to prioritize the order in which a particular hub is selected for failover.
        The lower the metric, the higher the priority of the interface to be selected during failover. If multiple hub virtual interfaces have the same metric value, SD-WAN sends new session traffic to them in round-robin fashion.
      11. Select the Path Monitoring mode.
        • Aggressive—Firewall sends probe packets to the opposite end of the SD-WAN link at a constant frequency. Use this mode if you need fast detection and failover for brownout and blackout conditions. Default for all link types except LTE and Satellite.
        • Relaxed—Firewall waits for a number of seconds (Probe Idle Time) between sending sets of probe packets, making path monitoring less frequent. When the probe idle time expires, firewall sends probes for 7 seconds at the Probe Frequency configured. Use this mode when you have low-bandwidth links, links that charge by usage (such as LTE), or when fast detection isn’t as important as preserving cost and bandwidth. Default for LTE and Satellite link types.
      12. Set the Probe Frequency (per second) to specify the number of times per second the firewall sends a probe packet to the opposite end of the SD-WAN link. The default setting provides subsecond detection of brownout and blackout conditions.
      13. Set the Probe Idle Time (seconds) to specify how long the firewall waits between sets of probe packets.
      14. Set the Failback Hold Time (seconds) to specify how long the firewall waits for a recovered link to remain qualified before the firewall reinstates the link after it has failed.
      15. Save.
    7. Configure a VPN cluster for your hub and branch firewalls.
      1. Select ConfigurationNGFW and Prisma AccessSetupAuto VPN and Add VPN Cluster.
      2. Check (enable) SD-WAN.
      3. Add the hub firewalls to the VPN cluster.
        1. Add Hub Devices to select one or more firewalls to Add as hubs.
          Up to four hubs are supported for a VPN cluster.
        2. Click the firewall in the Hub Devices list.
        3. Set the hub firewall Priority.
          Range is 1 to 4. The lower the priority value, the higher the priority and local preference. A cluster supports a maximum of four hubs. An active/passive HA pair counts as one hub. Multiple hubs can have the same priority; an HA pair must have the same priority.
        4. Select a Logical Router.
        5. (Optional) Check (enable) DIA VPN and select a DIA VPN Link Tag.
        6. Update.
        7. Repeat this step for all hub firewalls that you add to the VPN cluster.
      4. Add the branch firewalls to the VPN cluster.
        1. Add Hub Devices to select one or more firewalls to Add as hubs.
        2. Select a Logical Router.
        3. (Optional) Select a BGP Redistribution Profile.
        4. Update.
        5. Repeat this step for all branch firewalls that you add to the VPN cluster.
    8. Create SD-WAN link management profiles.

    © 2026 Palo Alto Networks, Inc. All rights reserved.