Use Case 3 - Protect Physical Security on LEO Satellite and 5G
Table of Contents
Expand all | Collapse all
-
-
- Add a Branch
- Add a Data Center
- Add a Branch Gateway
- Configure Circuits
- Configure Internet Circuit Underlay Link Aggregation
- Configure Private WAN Underlay Link Quality Aggregation
- Configure Circuit Categories
- Configure Device Initiated Connections for Circuits
- Add Public IP LAN Address to Enterprise Prefixes
- Manage Data Center Clusters
- Configure a Site Prefix
- Configure a DHCP Server
- Configure NTP for Prisma SD-WAN
- Configure the ION Device at a Branch Site
- Configure the ION Device at a Data Center
- Switch a Site to Control Mode
- Allow IP Addresses in Firewall Configuration
-
- Configure a Controller Port
- Configure Internet Ports
- Configure WAN/LAN Ports
- Configure a Loopback Interface
- Configure a PoE Port
- Configure and Monitor LLDP Activity and Status
- Configure a PPPoE Interface
- Configure a Layer 3 LAN Interface
- Configure Application Reachability Probes
- Configure a Secondary IP Address
- Configure a Static ARP
- Configure a DHCP Relay
- Configure IP Directed Broadcast
- VPN Keep-Alives
-
- Configure Prisma SD-WAN IPFIX
- Configure IPFIX Profiles and Templates
- Configure and Attach a Collector Context to a Device Interface in IPFIX
- Configure and Attach a Filter Context to a Device Interface in IPFIX
- Configure Global and Local IPFIX Prefixes
- Flow Information Elements
- Options Information Elements
- Configure the DNS Service on the Prisma SD-WAN Interface
- Configure SNMP
-
-
- Prisma SD-WAN Branch Routing
- Prisma SD-WAN Data Center Routing
-
- Configure Multicast
- Create a WAN Multicast Configuration Profile
- Assign WAN Multicast Configuration Profiles to Branch Sites
- Configure a Multicast Source at a Branch Site
- Configure Global Multicast Parameters
- Configure a Multicast Static Rendezvous Point (RP)
- Learn Rendezvous Points (RPs) Dynamically
- View LAN Statistics for Multicast
- View WAN Statistics for Multicast
- View IGMP Membership
- View the Multicast Route Table
- View Multicast Flow Statistics
- View Routing Statistics
- Prisma SD-WAN Incident Policies
-
- Prisma SD-WAN Branch HA Key Concepts
- Configure Branch HA
- Configure HA Groups
- Add ION Devices to HA Groups
- View Device Configuration of HA Groups
- Edit HA Groups and Group Membership
-
- Configure Branch HA with Gen-1 Platforms (2000, 3000, 7000, and 9000)
- Configure Branch HA with Gen-2 Platforms (3200, 5200, and 9200)
- Configure Branch HA with Gen-2 Embedded Switch Platforms (1200-S or 3200-L2)
- Configure Branch HA for Devices with Software Cellular Bypass (1200-S-C-5G)
- Configure Branch HA for Platforms without Bypass Pairs
- Prisma SD-WAN Clarity Reports
- Prisma SD-WAN Incidents and Alerts
Use Case 3 - Protect Physical Security on LEO Satellite and 5G
Use case to protect physical security on LEO satellite and 5G.
Where Can I Use
This? | What Do I
Need? |
---|---|
|
|
In this scenario, the business has many locations in remote geographies
where high speed wire line connectivity is unavailable. These locations have strict
requirements for physical security including video and audio surveillance as well as
access control. This traffic is tolerant to latency and jitter but loss can severely
impact operations. Due to the bandwidth demands both primary connections must be
used actively.
RTP-Base, RTP-Audio, RTSP, SIP, RTP-Video, and HID are configured with these path
policy rules:
- Active Paths:
- Prisma SD-WAN VPN on LEO Satellite Internet.
- Prisma SD-WAN VPN on Unmetered Public 5G.
- Backup Paths: None
- L3 Failure Paths: Prisma SD-WAN VPN on Internet ADSL.
Performance Policy Intent
- Use both of the Active Paths as long as they are SLA compliant.
- Use Link Quality Monitoring (LQM) information available from the Branch to Data Center VPNs to control Packet Duplication for any observed packet loss onto the active paths.
- If neither of the Active Paths are SLA compliant then begin to duplicate packets onto each of the active paths.
- If one of the two Active Paths is down and the other is degraded, perform single link packet duplication.
- Use the Internet ADSL Path if all of the Active Paths are down (not degraded).
- Generate an Incident to be forwarded to operations in case of non compliance with the SLA metrics.
Configure the Policy Rule
- Select the desired policy set from.ManagePrisma SD-WANPoliciesPerformance
- SelectAdd Ruleand enter theNameasProtect Physical Security Traffic,Description(optional), and theOrder Number(optional).More specific rules should be organized at the top of the Policy Set list, else a less specific policy rule may be matched first.
- In theActionssection, selectPacket Duplication,Move Flows, andCreate Incident.
- In theMatch Criteriasection, underApp Filters, select the applicationsRTP-Base,RTP-Audio,RTSP,SIP,RTP-Video, andHIDfrom the drop-down, select the category inPath FiltersasLEO Satellite InternetandUnmetered Public 5G. Select thePath TypeasPrisma SD-WAN VPN.
- In thePerformance SLAssection, clickAdd New, and check the optionLink Quality Metrics. Enter theSLA NameasPhysical Security SLA.
- InLink Quality Metrics, enter theJittervalue as 50 ms.This will use the best (lowest) measured Jitter value between the branch and all data centers on a per branch circuit basis.
- Click the+sign to enter theLatencyvalue as 200 ms and thePacket Lossvalue as 1%.
- Retain theAdvanced Settingsat their default values.
- Review theSummaryof the policy settings for the desired policy intent andSave & Exit.
Summary
: Implementing the
Performance Policy rule for Physical Security ensures the delivery of the business
critical traffic by mitigating consistent loss in the transport networks. The impact of
the rule is easily monitored using the App Site Details, Link Quality Metrics, and Flow
Browser.