Prisma Access Architecture and Design
What this domain tests
Architecture questions ask you to translate a customer topology into Prisma Access building blocks and justify placement, redundancy, and routing. You must distinguish a service connection (a tunnel from Prisma Access to a customer VPC or data center) from a remote network (a branch or campus tunnel into Prisma Access), and explain how mobile users attach through GlobalProtect.
Core rules
- Prisma Access runs in Palo Alto Networks cloud infrastructure. A compute location is a region where gateways and service infrastructure are deployed; choose locations for latency, capacity, and data-residency constraints.
- Mobile users authenticate to a portal and then connect to a gateway; portal and gateway can be in different compute locations.
- Service connections carry private traffic between Prisma Access and customer networks. Remote networks carry branch traffic into Prisma Access for inspection and internet egress.
- Redundancy: use two tunnels or two locations, ideally with BGP for deterministic failover; avoid a single ISP or single tunnel as a failure domain.
- Egress design: shared versus dedicated IPs, static versus dynamic addressing, and whether traffic exits locally or backhauls to a central location.
Worked example
A branch in Amsterdam needs internet access and private access to a Frankfurt data center. Design: deploy a remote network at the Amsterdam compute location for branch traffic, and a service connection at Frankfurt to the data center. Mobile users use Frankfurt and Amsterdam gateways. Why: the branch enters Prisma Access near its users, the private path terminates near the data center, and two mobile-user locations reduce latency and provide fallback. Add a second service connection tunnel with BGP for data-center redundancy.
Traps
- Confusing service connections with remote networks.
- Assuming the gateway sits inside the customer VPC.
- Ignoring overlapping private subnets and asymmetric routing.
- Sizing only for user count while ignoring bandwidth and tunnel limits.