SSE Engineer cheat sheet

SSE converges three core capabilities: secure web gateway (SWG), cloud access security broker (CASB), and zero trust network access (ZTNA), plus supporting functions such as FWaaS, DLP, and sandboxing.

SWG inspects and controls web traffic via URL filtering, TLS decryption, file scanning, and application control; CASB governs SaaS usage via discovery, inline control, and API-based scanning of sanctioned apps.

ZTNA replaces network-level access with per-application access: the user is authenticated and authorized to a specific app, and the connector initiates outbound connections so no inbound ports are exposed.

ZTNA differs from a classic VPN: VPN grants a broad network segment and places the user on the network; ZTNA grants least-privilege application access with continuous verification.

Security posture is enforced by a policy decision point evaluating identity, device posture, and context; the enforcement point sits in the cloud edge near the user, not in the data center.

Inline CASB inspects traffic in the data path in real time; API-based CASB polls the SaaS provider out-of-band for at-rest data and shadow IT discovery, so the two are complementary, not substitutes.

TLS decryption is a prerequisite for most SSE inspection; without it, URL category, file type, and content controls see only SNI and certificate metadata.

Shadow IT discovery classifies unsanctioned SaaS by traffic signatures and risk scoring; sanctioning an app moves it from block/alert to controlled inline policy.

Single-pass parallel processing (SP3) architecture performs App-ID, User-ID, Content-ID, and threat inspection in one pass, avoiding repeated decode of the same stream.

Prisma Access is configured from the Strata Cloud Manager (or Panorama) management plane; the management plane pushes config to the multitenant cloud infrastructure, which hosts the compute locations.

Deployment types: Mobile Users (GlobalProtect remote access), Remote Networks (IPsec tunnels from branch to the nearest compute location), Service Connections (IPsec from data center to access private apps and internet), and Explicit Proxy.

A service connection carries traffic between the customer network and Prisma Access; remote networks carry branch traffic; mobile users terminate GlobalProtect tunnels on the same infrastructure.

Compute locations are grouped into regions; the closest compute location is selected for mobile users via GlobalProtect portal settings, and remote networks are pinned to a region.

Mobile user licensing (e.g., per-user subscriptions) differs from bandwidth licensing for remote networks and service connections; sizing is driven by peak concurrent users and throughput.

GlobalProtect configuration requires a portal (user authentication, config selection) and gateways (tunnel parameters, split tunneling). In Prisma Access both are cloud-hosted and configured under Mobile Users.

Split tunneling rules determine which destinations go through the tunnel and which go direct; exclude lists reduce cloud traffic but bypass SSE inspection for those destinations.

Onboarding order: license activation, service connection setup, remote network setup, mobile user config, then security policy and decryption policy pushed to the cloud.

Identity integration uses Cloud Identity Engine, SAML/IdP, or on-premises User-ID agents; group mapping is required for user- and group-based policy in the cloud.

IPsec tunnels use IKEv2 by default; proposal, PSK or certificate, and local/peer identities must match on both ends or phase 1 fails.

Remote network and service connection tunnels terminate on cloud service IPs; the customer edge must allow UDP 500/4500 and ESP, or use NAT-T when behind NAT.

BGP is the dynamic routing option for service connections and remote networks; eBGP peering uses the tunnel interface addresses, with the customer side typically advertising private prefixes.

Static routes are supported but do not fail over automatically; BGP provides path failover and prefix advertisement to the cloud.

Traffic steering for mobile users uses GlobalProtect internal/external host detection and the closest-compute-location selection; no-split-tunnel sends all traffic to the cloud.

Return traffic symmetry matters: if a service connection advertises a prefix, the cloud routes that prefix back through the tunnel, so the customer must not advertise overlapping or default routes unintentionally.

Tunnel monitoring (dead peer detection) and path monitoring determine failover between redundant tunnels; configure two tunnels to different cloud locations for resilience.

DNS and proxy settings: explicit proxy deployments require PAC file or proxy settings on endpoints; GlobalProtect can push DNS and split-tunnel domains.

Routing inside the cloud uses the service infrastructure; the customer cannot see or modify the cloud's internal routing table, only the routes exchanged over the tunnel.

Policy evaluation is top-down, first match wins; a rule matches on source zone/address/user, destination zone/address, application, service, and URL category, with implicit deny at the end.

App-ID identifies the application regardless of port; use application-default service or explicit ports only when required, and avoid any/any rules.

Security profiles attach to allow rules: Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, WildFire Analysis, File Blocking, and DNS Security.

SSL decryption policy is evaluated before security policy; decryption rules match on URL category, source user, and destination, and can be no-decrypt for privacy or legal exclusions.

WildFire submits unknown files and returns a verdict; a WildFire Analysis profile can be set to forward or forward-and-block based on verdict.

DNS Security detects malicious domains at resolution time using predictive analysis and threat intelligence, catching command-and-control before the TCP connection.

Best-practice posture: default-deny between zones, decryption for outbound web, security profiles on all allow rules, and logging at session end for visibility.

Zone protection profiles defend against flood, reconnaissance, and packet-based attacks at the ingress zone, before policy evaluation.

Credential theft prevention and SaaS inline controls require decryption plus a CASB or SaaS security policy with the appropriate license.

Troubleshooting order for connectivity: license and deployment status, tunnel/IKE status, routing, security policy, then NAT and decryption.

IKE phase 1 failure symptoms: no proposal match, PSK mismatch, identity mismatch, or blocked UDP 500/4500; check the IKE logs and the peer's proposal list.

IKE phase 2 failure usually indicates proxy-ID or traffic-selector mismatch, or a proposal mismatch; confirm the local/remote subnets match on both sides.

GlobalProtect connection failures: check portal/gateway reachability, certificate validity, authentication (SAML/IdP) response, and HIP check results.

Log types to inspect: Traffic, Threat, URL Filtering, WildFire Submissions, Decryption, GlobalProtect, and System logs; correlate by session ID across types.

Prisma Access status and health are viewed in the management plane's Prisma Access status page and via the cloud services status API; alarms cover license, tunnel, and compute health.

Common causes of asymmetric routing: overlapping advertised prefixes, split tunneling sending some traffic direct, and multiple service connections with different metrics.

Decryption failures show as certificate errors or blocked sessions in the Decryption log; check forward-trust and forward-untrust certificate settings and exclusion lists.

Use packet capture on the customer edge and cloud-side tunnel counters to distinguish loss on the internet path from policy drops in the cloud.

SSE converges three core capabilities: secure web gateway (SWG), cloud access security broker (CASB), and zero trust network access (ZTNA), plus supporting functions such as FWaaS, DLP, and sandboxing.

SWG inspects and controls web traffic via URL filtering, TLS decryption, file scanning, and application control; CASB governs SaaS usage via discovery, inline control, and API-based scanning of sanctioned apps.

ZTNA replaces network-level access with per-application access: the user is authenticated and authorized to a specific app, and the connector initiates outbound connections so no inbound ports are exposed.

ZTNA differs from a classic VPN: VPN grants a broad network segment and places the user on the network; ZTNA grants least-privilege application access with continuous verification.

Security posture is enforced by a policy decision point evaluating identity, device posture, and context; the enforcement point sits in the cloud edge near the user, not in the data center.

Inline CASB inspects traffic in the data path in real time; API-based CASB polls the SaaS provider out-of-band for at-rest data and shadow IT discovery, so the two are complementary, not substitutes.

TLS decryption is a prerequisite for most SSE inspection; without it, URL category, file type, and content controls see only SNI and certificate metadata.

Shadow IT discovery classifies unsanctioned SaaS by traffic signatures and risk scoring; sanctioning an app moves it from block/alert to controlled inline policy.

Single-pass parallel processing (SP3) architecture performs App-ID, User-ID, Content-ID, and threat inspection in one pass, avoiding repeated decode of the same stream.

SSE converges three core capabilities: secure web gateway (SWG), cloud access security broker (CASB), and zero trust network access (ZTNA), plus supporting functions such as FWaaS, DLP, and sandboxing.

SWG inspects and controls web traffic via URL filtering, TLS decryption, file scanning, and application control; CASB governs SaaS usage via discovery, inline control, and API-based scanning of sanctioned apps.

ZTNA replaces network-level access with per-application access: the user is authenticated and authorized to a specific app, and the connector initiates outbound connections so no inbound ports are exposed.

ZTNA differs from a classic VPN: VPN grants a broad network segment and places the user on the network; ZTNA grants least-privilege application access with continuous verification.

Security posture is enforced by a policy decision point evaluating identity, device posture, and context; the enforcement point sits in the cloud edge near the user, not in the data center.

Inline CASB inspects traffic in the data path in real time; API-based CASB polls the SaaS provider out-of-band for at-rest data and shadow IT discovery, so the two are complementary, not substitutes.

TLS decryption is a prerequisite for most SSE inspection; without it, URL category, file type, and content controls see only SNI and certificate metadata.

Shadow IT discovery classifies unsanctioned SaaS by traffic signatures and risk scoring; sanctioning an app moves it from block/alert to controlled inline policy.

Single-pass parallel processing (SP3) architecture performs App-ID, User-ID, Content-ID, and threat inspection in one pass, avoiding repeated decode of the same stream.

Prisma Access is configured from the Strata Cloud Manager (or Panorama) management plane; the management plane pushes config to the multitenant cloud infrastructure, which hosts the compute locations.

Deployment types: Mobile Users (GlobalProtect remote access), Remote Networks (IPsec tunnels from branch to the nearest compute location), Service Connections (IPsec from data center to access private apps and internet), and Explicit Proxy.

A service connection carries traffic between the customer network and Prisma Access; remote networks carry branch traffic; mobile users terminate GlobalProtect tunnels on the same infrastructure.

Compute locations are grouped into regions; the closest compute location is selected for mobile users via GlobalProtect portal settings, and remote networks are pinned to a region.

Mobile user licensing (e.g., per-user subscriptions) differs from bandwidth licensing for remote networks and service connections; sizing is driven by peak concurrent users and throughput.

GlobalProtect configuration requires a portal (user authentication, config selection) and gateways (tunnel parameters, split tunneling). In Prisma Access both are cloud-hosted and configured under Mobile Users.

Split tunneling rules determine which destinations go through the tunnel and which go direct; exclude lists reduce cloud traffic but bypass SSE inspection for those destinations.

Onboarding order: license activation, service connection setup, remote network setup, mobile user config, then security policy and decryption policy pushed to the cloud.

Identity integration uses Cloud Identity Engine, SAML/IdP, or on-premises User-ID agents; group mapping is required for user- and group-based policy in the cloud.

IPsec tunnels use IKEv2 by default; proposal, PSK or certificate, and local/peer identities must match on both ends or phase 1 fails.

Remote network and service connection tunnels terminate on cloud service IPs; the customer edge must allow UDP 500/4500 and ESP, or use NAT-T when behind NAT.

BGP is the dynamic routing option for service connections and remote networks; eBGP peering uses the tunnel interface addresses, with the customer side typically advertising private prefixes.

Static routes are supported but do not fail over automatically; BGP provides path failover and prefix advertisement to the cloud.

Traffic steering for mobile users uses GlobalProtect internal/external host detection and the closest-compute-location selection; no-split-tunnel sends all traffic to the cloud.

Return traffic symmetry matters: if a service connection advertises a prefix, the cloud routes that prefix back through the tunnel, so the customer must not advertise overlapping or default routes unintentionally.

Tunnel monitoring (dead peer detection) and path monitoring determine failover between redundant tunnels; configure two tunnels to different cloud locations for resilience.

DNS and proxy settings: explicit proxy deployments require PAC file or proxy settings on endpoints; GlobalProtect can push DNS and split-tunnel domains.

Routing inside the cloud uses the service infrastructure; the customer cannot see or modify the cloud's internal routing table, only the routes exchanged over the tunnel.

Policy evaluation is top-down, first match wins; a rule matches on source zone/address/user, destination zone/address, application, service, and URL category, with implicit deny at the end.

App-ID identifies the application regardless of port; use application-default service or explicit ports only when required, and avoid any/any rules.

Security profiles attach to allow rules: Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, WildFire Analysis, File Blocking, and DNS Security.

SSL decryption policy is evaluated before security policy; decryption rules match on URL category, source user, and destination, and can be no-decrypt for privacy or legal exclusions.

WildFire submits unknown files and returns a verdict; a WildFire Analysis profile can be set to forward or forward-and-block based on verdict.

DNS Security detects malicious domains at resolution time using predictive analysis and threat intelligence, catching command-and-control before the TCP connection.

Best-practice posture: default-deny between zones, decryption for outbound web, security profiles on all allow rules, and logging at session end for visibility.

Zone protection profiles defend against flood, reconnaissance, and packet-based attacks at the ingress zone, before policy evaluation.

Credential theft prevention and SaaS inline controls require decryption plus a CASB or SaaS security policy with the appropriate license.

Troubleshooting order for connectivity: license and deployment status, tunnel/IKE status, routing, security policy, then NAT and decryption.

IKE phase 1 failure symptoms: no proposal match, PSK mismatch, identity mismatch, or blocked UDP 500/4500; check the IKE logs and the peer's proposal list.

IKE phase 2 failure usually indicates proxy-ID or traffic-selector mismatch, or a proposal mismatch; confirm the local/remote subnets match on both sides.

GlobalProtect connection failures: check portal/gateway reachability, certificate validity, authentication (SAML/IdP) response, and HIP check results.

Log types to inspect: Traffic, Threat, URL Filtering, WildFire Submissions, Decryption, GlobalProtect, and System logs; correlate by session ID across types.

Prisma Access status and health are viewed in the management plane's Prisma Access status page and via the cloud services status API; alarms cover license, tunnel, and compute health.

Common causes of asymmetric routing: overlapping advertised prefixes, split tunneling sending some traffic direct, and multiple service connections with different metrics.

Decryption failures show as certificate errors or blocked sessions in the Decryption log; check forward-trust and forward-untrust certificate settings and exclusion lists.

Use packet capture on the customer edge and cloud-side tunnel counters to distinguish loss on the internet path from policy drops in the cloud.