PSE SASE cheat sheet

ZTNA connectors are deployed as VM-Series or Prisma Access explicit-proxy Connector appliances in internal networks; they make outbound-only connections to Prisma Access so no inbound pinholes are required.

Publish internal apps as ZTNA applications with a FQDN or IP; users resolve the app FQDN to a Prisma Access public IP, and the proxy tunnels traffic to the Connector that hosts the app.

ZTNA access is enforced by security policy: rules match on source user/group, destination app, and application; default-deny applies when no rule matches.

Authentication uses an IdP via SAML/OIDC (SCIM for group sync); user-to-group mapping drives policy, so IdP group claims must be verified before writing rules.

Connector high availability: deploy at least two Connectors per site; Prisma Access load-balances across Connectors registered to the same tenant and app.

ZTNA does not expose the app's real IP to the user; the app's private address stays hidden behind the Connector tunnel, which is the core difference from traditional VPN.

Split-tunnel vs full-tunnel: GlobalProtect on Prisma Access supports split tunneling by domain/route; ZTNA app traffic goes to the proxy regardless of tunnel mode.

Use the Prisma Access status/insights dashboards to verify Connector up/down state and tunnel health; a down Connector removes its app path and can black-hole traffic if no second Connector exists.

Prisma SD-WAN (formerly CloudGenix) uses ION devices at branch sites; the ION builds encrypted tunnels to Prisma Access or to a data center, not a traditional hub-and-spoke router mesh.

Policies are defined centrally in the Prisma SD-WAN portal (Strata Cloud Manager) and pushed to IONs; the ION enforces path selection per application.

Path selection uses per-app policy: performance-based (latency/jitter/loss thresholds), priority-based, or direct internet breakout; traffic steers across multiple WAN links.

Application definitions classify traffic by IP/port, domain, or SaaS app signature; the classification determines which path-selection policy applies.

Prisma SD-WAN integrates with Prisma Access for secure direct internet breakout: branch SaaS traffic exits locally through Prisma Access instead of backhauling to the data center.

QoS on ION uses per-app bandwidth allocation and shaping; oversubscription is handled by policy priority, not by static interface queues alone.

WAN link health is monitored with continuous probes; a link failing the SLA threshold is de-prioritized automatically, and the flow fails over to the next-best path.

Branch HA uses dual IONs in an HA pair; the pair shares a virtual IP so WAN-side failover is transparent to downstream switches.

Prisma Browser (formerly Prisma Access Browser) is an enterprise browser built on Chromium that enforces security policy at the browser layer, independent of the endpoint OS.

It provides zero-trust access to private web apps without a full VPN client; the browser itself establishes the secure tunnel to Prisma Access.

Data controls include copy/paste restriction, download/upload blocking, screenshot prevention, and watermarking, applied per policy and per app.

Browser isolation renders untrusted or unknown sites in a remote container so malicious content never executes on the endpoint.

Sessions are tied to the user's IdP identity; policy can restrict access by user group, device posture, and app, and the browser enforces it client-side.

Because the browser is the enforcement point, unmanaged or BYOD devices can access internal apps without installing a GlobalProtect client.

Prisma Browser coexists with GlobalProtect: GlobalProtect handles network-level tunnel and Prisma Browser handles app-level zero-trust web access.

Logs from Prisma Browser feed the same Prisma Access/Cortex logging pipeline, so browser events are queryable alongside firewall and ZTNA events.

SaaS Security (CASB) scans sanctioned SaaS apps via API for data-at-rest risks: exposed files, misconfigured sharing, and sensitive data in cloud storage.

Inline protection uses a forward proxy or Prisma Access secure web gateway to inspect SaaS traffic in real time; API mode cannot block in-flight uploads.

SaaS posture management (SSPM) checks app configurations against benchmarks: MFA enforcement, admin role sprawl, and public-sharing defaults.

Shadow IT discovery identifies unsanctioned SaaS by traffic signatures and classifies apps by risk score; the tenant admin then sanctions or blocks the app.

DLP policies in SaaS Security match on data patterns (credit cards, SSNs, custom regex) and can quarantine or remove public shares of matching files.

API-based scanning requires OAuth authorization from the SaaS tenant admin; the scan scope is limited to what the granted scopes allow.

Tenant control (e.g., blocking uploads to personal instances) is enforced inline; API mode can only remediate after the fact.

SaaS Security integrates with Enterprise DLP so the same data patterns and incident workflows apply to SaaS, web, and endpoint channels.

Enterprise DLP has three building blocks: data patterns (what to detect), data profiles (pattern plus weighting/threshold), and DLP rules (where and what action).

Data patterns include predefined types (credit card, SSN, driver's license) and custom regex or keyword patterns; predefined patterns include validation logic such as Luhn for cards.

A data profile combines patterns with a confidence/weight threshold; a match fires when the combined score meets the threshold, reducing false positives.

DLP rules are attached to security policy rules (firewall, SaaS, or Prisma Browser) and specify action: allow, alert, block, or quarantine.

Inline DLP inspects traffic in flight (web, SaaS uploads, email); API DLP scans data at rest in SaaS apps; the same profile can be reused across both.

File-based DLP inspects content types (PDF, Office, archives); encrypted or password-protected archives may not be inspectable, so policy must handle that case.

Incidents are logged to Cortex Data Lake / Strata Cloud Manager and can be forwarded to SIEM; incident severity and notification are configured per rule.

DLP for Prisma Browser enforces on copy/paste, upload, and download at the browser layer; DLP for SaaS Security remediates shared files after API scan.