Prisma Access Deployment and Configuration
What this domain tests
Deployment questions test whether you can turn a design into working configuration in Strata Cloud Manager (SCM) or Panorama, with correct scoping, tunnel parameters, and push targets.
Core rules
- Onboarding starts with tenant activation and licensing, then service setup: authentication, DNS, and egress IP configuration.
- In SCM, configuration is organized into global, folder, and snippet scopes. Device configuration is pushed separately to Mobile Users, Remote Networks, and Service Connections.
- Remote networks require an IKE gateway, IPsec crypto profile, IPsec tunnel, and usually BGP. Prefer IKEv2, strong proposals, and two tunnels for high availability.
- Service connections use the same tunnel primitives plus route advertisement. Avoid overlapping subnets and asymmetric paths.
- Identity: configure SAML/SCIM or LDAP, GlobalProtect certificates, and HIP profiles when posture checks are required.
Worked example
A branch has two ISPs and must survive one ISP failure. Configure two IPsec tunnels from the branch to the same remote network location, each with its own IKE gateway and peer IP. Run BGP over both, prefer one path with local preference, and advertise only summarized branch routes. Push to Remote Networks and verify IKE/IPsec SAs and BGP routes. Why: two tunnels remove a single ISP as a failure domain, and BGP gives deterministic failover without relying on static routes.
Traps
- Pushing policy only to Mobile Users and forgetting Remote Networks.
- Using IKEv1 or mismatched proposals; MTU/MSS problems break large flows.
- Overlapping private subnets between service connections and remote networks.
- Assuming one commit applies to every deployment target.