Prisma SD-WAN uses mapping of Standard VPN services and Prisma SD-WAN data centers to allow flexibility when creating network policy rules, while accounting for uniqueness across sites. For example, an administrator may want to create a single network policy that directs all HTTP and SSL Internet bound traffic through the closest Zscaler Enforcement Node (ZEN) in the region if it is available and meets the application SLA, but if not, may leverage a Prisma SD-WAN Data Center site as a transit point.

This is where the concept of endpoints, groups, and domains come into play. To leverage the underlying resources available to an administrator, it is important to understand how an endpoint, group, and domain work in the Prisma SD-WAN system.

Endpoint - A service endpoint is a label representing a specific location or network service. It can be of type Prisma SD-WAN, specifically Prisma SD-WAN Data Centers for Data Center transit services, or of type Standard VPN. In this release, the only Standard VPN service that can be configured VarPeN s to cloud security services. However, in a subsequent release, there could be other network services that would use this same construct.

Group - A service group is label representing a set of common service endpoint types. This service group label will be used in network policy rules to express intent to allow or force traffic to the defined service endpoint(s). It can be of type Prisma SD-WAN or Standard VPN and may contain zero or more service endpoints.

Domain - A domain is a collection of groups which can be assigned to a set of sites. There can be multiple domains defined, but a site may only be assigned to one domain at a time.

Let us further explore the concept of endpoints, groups, and domains using the following illustration and screenshot.

The illustration displays how endpoints added to a group are associated with a domain. The domains are then bound to a site, thus mapping Standard VPN services or Prisma SD-WAN data centers uniquely for each site. Note that a group, with different endpoints, can be mapped to one or more domains and a domain can be mapped to one or more sites.

For a customer with sites in North America and Europe that has one Prisma SD-WAN enabled data center in each region and has adopted Zscaler within each region the domain mapping is accomplished as follows: