Backhaul, Breakout and Compute Location Sizing for a Global Manufacturer
Northwind Industrial is a manufacturer with 6,500 mobile users in 32 countries and 55 branch offices connected by MPLS to data centers in Chicago and Frankfurt. All branch internet traffic backhauls to Chicago, where a PA-5220 inspects it before egress. SaaS now accounts for roughly 70% of branch traffic, and video calls from Southeast Asia traverse Chicago, adding 180–220 ms of latency that users complain about weekly. The security team has budget for Prisma Access next fiscal year and must decide how branches and data centers are connected, how many compute locations to license, and how to serve 2,000 contractor users who work on locked-down VDI desktops where no endpoint agent can be installed. Compliance requires 12 months of traffic log retention and forbids storing cardholder data outside the two data centers. The network team has no cloud interconnects (no ExpressRoute, no Direct Connect) and a six-month deadline.
1. How should the 55 branches and the two data centers be connected to Prisma Access, and how many compute locations should be licensed? Justify the design against the latency and compliance constraints.
Read the worked answer
Treat this as two separate flows that need two different Prisma Access constructs.
Branch internet/SaaS - remote networks. Each site gets a remote network: an IPSec tunnel from the branch CPE/SD-WAN edge to a nearby compute location, with internet-bound traffic breaking out there. That removes the 180–220 ms backhaul, which is the actual complaint. Prisma Access provides two tunnels per remote network; terminate them on diverse CPEs if the site has them.
Private applications - service connection. With no ExpressRoute or Direct Connect, the service connection is IPSec over internet from Chicago and Frankfurt, two tunnels per compute location, BGP for failover. A remote network tunnel alone does not give a branch user access to a DC application: the path is branch → compute location → service connection → DC, and the return path from the core must route the branch subnets back through Prisma Access.
Compute locations. Do not license two because there are two data centers. Choose locations by round-trip time from real user populations. Chicago and Frankfurt cover North America and Europe and sit next to the DCs; Southeast Asian mobile users would still be 150+ ms from Frankfurt, so either add a Singapore or Tokyo location or document the acceptance. Resilience comes from more than one location plus two tunnels each, not from a single location's internal redundancy.
Compliance. Prisma Access is pass-through, but decryption renders cardholder payloads readable in the compute location and WildFire submission sends files out. Scope the payment flows to no-decrypt and exclude them from file submission. Confirm Cortex Data Lake retention reaches 12 months under your license, or forward logs to your own SIEM - don't assume.
2. For the 2,000 contractors on VDI, would you use GlobalProtect or Explicit Proxy? Explain the trade-offs and what you would validate before committing.
Read the worked answer
Explicit proxy is the lower-risk default for VDI, but it is a narrower control.
Explicit proxy pros: no agent to install, so it works on locked-down desktops; a PAC file steers browser traffic to the Prisma Access proxy, where URL filtering, decryption, threat prevention and DLP still apply to HTTP/HTTPS. Because it is browser-scoped, there is no split-tunnel question and no interaction with the VDI image.
Explicit proxy limits: only web protocols are inspected. SSH, RDP, thick-client TCP and anything else goes direct and unprotected. There is no HIP posture check. User identification depends on proxy authentication, which on shared or non-interactive VDI sessions may prompt every session or fail silently - validate against your VDI platform before rollout, and decide how the identity reaches Prisma Access.
GlobalProtect trade-offs: better because it captures all traffic and gives clean User-ID and HIP, but multi-user VDI requires confirming the supported per-user or per-machine deployment model for your Prisma Access release, and HIP on a shared desktop means little.
Recommendation: GlobalProtect on managed contractor laptops; Explicit Proxy with a PAC file for the VDI pool, plus a network-level restriction so VDI desktops cannot bypass the proxy. Pilot one VDI pool, confirm authentication behavior and App-ID visibility on your top ten apps, then scale.
3. Six months in, the Frankfurt compute location is at 85% of licensed bandwidth at peak while Chicago sits at 40%. What options would you evaluate, and what evidence would you need first?
Read the worked answer
Start by ruling out that the Frankfurt number is real demand rather than traffic that should not be there.
Evidence to collect: Prisma Access Insights bandwidth trends per compute location and per remote network/mobile user group; the top applications and top source sites at peak; the share of traffic that is backup, OS updates, video, or personal streaming; and whether the peak aligns with a specific office's working hours. Check whether decryption is creating unexpected egress paths and whether any branch is hairpinning through Frankfurt to reach a DC it could reach more directly.
Then weigh the options:
- Reduce demand - QoS or bandwidth limits on non-business apps, local breakout for trusted SaaS categories, throttling backup windows out of peak.
- Redistribute - move some remote networks or mobile user gateway preferences to a location with headroom if latency allows. This only works if the users are genuinely closer to the alternative.
- Re-architect - a service connection or peering that shortens paths for the heaviest flows.
- Buy more bandwidth - the last resort, because it is the only option that costs money forever and the least likely to survive the next traffic growth curve.
Note that licensed bandwidth is a commercial ceiling, so sustained 85% at peak is a capacity decision, not a fault. Present the peak and 95th-percentile figures with the top-talker breakdown, not a single screenshot, so the decision is about traffic composition rather than a number.