Configure and Install Prisma Access for Networks (managed
by Panorama)
3.1.2
Configure the Prisma SD-WAN CloudBlade to
prepare the Prisma SD-WAN Controller for integration.
From the Prisma SD-WAN web
interface, select CloudBlades.
In CloudBlades, locate the Prisma Access
for Networks Integration (managed by Panorama) CloudBlade
and click Configure. If this CloudBlade does
not appear in the list, contact Prisma SD-WAN Support.
Select the Prisma Access for Networks (managed
by Panorama) CloudBlade to view the CloudBlade Installation
page. Enter the following information in the fields shown below,
change where appropriate:
VERSION: Select the version
of the Prisma Access for Networks (managed by Panorama) CloudBlade.
ADMIN STATE: For Admin State, select/retain Enabled.
PANORAMA SERIAL NUMBER: Enter the serial
number of the Panorama API endpoint.
ION PEERING DEFAULT LOCAL AS NUMBER:
Starting with version 2.0.3 and higher, a BGP Local AS number is
defined to quickly on-board ECMP sites. This can be any 16-bit AS
number, but private BGP AS number(s) are recommended.
TUNNEL IDENTIFIER, PRISMA ACCESS FOR NETWORKS SIDE:
Enter an FQDN IKE identifier in name@domain.com format. This identifier
will be used by Prisma Access to identify remote tunnel connections.
TUNNEL IDENTIFIER TEMPLATE, PRISMA SD-WAN SIDE:
Enter an FQDN IKE identifier in name@domain.com format. This identifier
should be different from the Prisma Access identifier. This identifier
will be used as a template to generate a unique ID per tunnel.
TUNNEL INNER IP POOL: Specify an IP pool
using IP/Mask notation. This IP Pool should be unused or unique
across the entire network and should not be used by the Palo Alto
Service Infrastructure Subnet.
The number of tunnels that
can be created in the Prisma SD-WAN Fabric to Prisma Access are
directly limited by this configuration. Each tunnel will use a /31
subnet from this pool.
TUNNEL PSK SEED: Specify a string of
text which will be used to derive the unique pre-shared keys (PSKs)
used per tunnel.
Optional PANORAMA TENANT NAME:
Specify the Tenant Name that will be used for Remote Networks with
the CloudBlade.
ENFORCE DEFAULT PRISMA SD-WAN LIVELINESS PROBES:
For Prisma Access, the default is to leverage an ICMP probe to the
last Prisma Access Infrastructure IP address.
Click Install after the settings
are configured.
If you select/change the version of the CloudBlade,
you must re-enter all the configuration values for that particular
CloudBlade version.