I85PREP
⌘ K
SSE Engineer study materials
SSE Engineer study resources

SSE Engineer: Prisma Access Configuration and Deployment

SSE Engineer · Work through your exam, one topic at a time.

All guide sections

Prisma Access Configuration and Deployment

Declare intent, do not build tunnels by hand

Configuration lives in Strata Cloud Manager, with the older Panorama plugin still used in some estates. Field names and workflows differ between the two, so know which one the scenario describes before answering. You declare licenses, identity, service connections, remote networks and mobile users, then commit.

Onboarding order that survives an audit

  1. Activate the Prisma Access license, associate it with the tenant and confirm add-ons (WildFire, DNS Security, CASB, DLP, SD-WAN, ZTNA Connector).
  2. Configure identity: Cloud Identity Engine, IdP, SCIM, authentication profiles.
  3. Add service connections with IPSec termination and BGP or static routing.
  4. Add remote networks with their subnets, tunnel settings and bandwidth.
  5. Configure mobile users: IP pools, portals and gateways, HIP, split tunnelling.
  6. Allocate bandwidth per compute location before committing - under-allocation is the classic commit rejection.
  7. Commit, then verify health in Insights and Command Center.

Addressing rules

Mobile-user IP pools must not overlap internal subnets or service connection ranges. Overlapping branch subnets must be resolved before a remote network is added, because Prisma Access routes purely on destination prefix. Each service connection needs a /32 loopback for BGP peering, and the private prefixes must be advertised, not merely tunnelled.

Worked example

Two branches both use 192.168.1.0/24. The second remote network fails validation. Options: renumber one branch, or source-NAT that branch at its CPE and advertise a unique summary. Renumbering is cleaner; NAT breaks return-path symmetry unless the CPE keeps state for the translated flow.

Traps

  • Committing before bandwidth allocation and reading the rejection as a licensing fault.
  • Assuming a service connection automatically gives branches access to data center subnets without route advertisement.
  • Mixing Panorama-plugin terminology into a Strata Cloud Manager answer.