SD-WAN Deployment and Configuration
Domain 1: SD-WAN Deployment and Configuration
This domain tests how you bring a Prisma SD-WAN branch online: claiming ION hardware, defining sites, configuring WAN/LAN interfaces and circuits, establishing the secure fabric, and applying site-level policy. The exam favors operational order and scope: what is configured globally, at a site, or on a single device.
Core rules
- Zero-touch provisioning starts with the device serial number claimed in the Prisma SD-WAN Controller/Command Center; the ION then authenticates outbound to the controller and receives its site/device configuration.
- A site is the policy and topology boundary; devices inherit site settings, but device-level overrides can break inheritance.
- Each WAN interface needs the correct circuit category (public/private, broadband/MPLS), bandwidth, and IP method (DHCP, static, PPPoE). Bandwidth feeds QoS and path calculations.
- The overlay is an IPsec-based secure fabric between IONs; underlay reachability, DNS, NTP, and outbound controller access must work before tunnels form.
- HA pairs normally use active/standby with redundant circuits and VRRP; mismatched models or licensing can block the pair.
Worked example
A branch has a 100/100 Mbps fiber ISP and a 50/50 Mbps LTE backup. Claim the ION, create the site, add both WAN interfaces, label fiber as public broadband and LTE as public broadband backup, enter the real bandwidths, then attach the site network policy. The controller builds fabric tunnels over both circuits. If you omit bandwidth, QoS and path selection treat the links incorrectly; if you skip the claim, the device never receives configuration.
Traps
Do not confuse site scope with device scope. Do not configure duplicate subnets on two WAN interfaces. Do not assume a powered ION is managed before it is claimed and has controller reachability. Do not forget that HA and circuit failover depend on correct interface roles and health checks.