SD-WAN Security and Prisma SASE Integration
Domain 3: SD-WAN Security and Prisma SASE Integration
This domain tests branch segmentation and cloud-delivered security: ION zone-based policy, NAT, and the integration of Prisma SD-WAN with Prisma SASE/Prisma Access for SWG, FWaaS, CASB, DLP, and ZTNA. Know which control belongs on the ION and which belongs in Prisma Access.
Core rules
- ION security is zone-based: assign interfaces to trust, untrust, guest, or custom zones, then write allow/deny rules between zones. NAT translates guest or branch traffic to the WAN.
- Prisma SD-WAN does not replace a full NGFW inspection stack. For advanced web, SaaS, and data security, steer traffic to Prisma Access through a service connection or CloudBlade integration.
- Prisma Access uses remote networks and service connections; the SD-WAN CloudBlade automates branch onboarding and tunnel/service connection setup.
- ADEM provides digital experience monitoring for SASE paths; ZTNA Connector publishes private apps without exposing them to the internet.
- Security policy must be consistent: if corporate traffic requires inspection, do not let an application policy send it directly to the internet.
Worked example
A site has corporate and guest VLANs. Put the corporate interface in a trust zone, guest in a guest zone, and both WAN interfaces in untrust. Create a guest rule allowing only HTTP/HTTPS to untrust, with source NAT to the WAN; deny guest-to-trust. For corporate SaaS, attach the branch to Prisma Access through the CloudBlade, use the service connection, and set the application policy to send sanctioned SaaS through the SASE tunnel. Guest breakout stays local to save backhaul; corporate traffic gets SWG/CASB inspection. If the corporate rule sends SaaS direct, inspection is bypassed.
Traps
Assuming every ION rule provides full IPS/AV is wrong. Putting NAT or security rules in the wrong order can block return traffic. Forgetting that ZTNA is for private applications, not general internet breakout, is common. An application policy that bypasses Prisma Access undermines the SASE design.