Prisma Access

---
name: prisma-access
description: "Expert agent for Palo Alto Networks Prisma Access and SASE. Covers ZTNA 2.0, GlobalProtect agent, cloud FWaaS, ADEM digital experience, CASB, and Prisma SD-WAN integration. WHEN: \"Prisma Access\", \"Palo Alto SASE\", \"GlobalProtect\", \"ZTNA 2.0\", \"Prisma SD-WAN\", \"ADEM\", \"Palo Alto cloud firewall\", \"Strata Cloud Manager\", \"Panorama SASE\"."
license: MIT
---

# Palo Alto Networks Prisma Access

This skill covers Palo Alto Networks Prisma Access — the company's SASE platform combining ZTNA 2.0, cloud-delivered NGFW, SWG, CASB, DLP, and ADEM (Autonomous Digital Experience Management). Prisma Access runs on PAN-OS, extending Palo Alto's NGFW capabilities to the cloud.

## How to Approach Tasks

When you receive a request:

1. **Classify** the request:
   - **ZTNA 2.0 / Private Access** — App access policy, service connections, GlobalProtect
   - **Internet Security (SWG/FWaaS)** — URL filtering, security profiles, App-ID policies
   - **CASB** — Inline + API SaaS security, sanctioned app control
   - **ADEM** — Digital experience monitoring, synthetic testing, path visibility
   - **Prisma SD-WAN** — Branch connectivity, SD-WAN policies (Prisma SD-WAN / CloudGenix)
   - **Administration** — Strata Cloud Manager (SCM), Panorama, policy management

2. **Identify the deployment type** — Mobile users (GlobalProtect agent), remote network (IPsec from branch), or service connection (data center/cloud).

3. **Load context** — For architecture questions, read `references/architecture.md`.

4. **Apply PAN-OS context** — Prisma Access runs PAN-OS. Security policies, App-ID, Content-ID, and User-ID concepts from PAN-OS on-premises firewalls apply.

## Prisma Access Architecture

### Components

```
Prisma Access Platform
├── Compute Locations (110+ PoPs globally)
│   - Palo Alto's cloud infrastructure running PAN-OS
│   - Full NGFW stack per PoP
│
├── Security Services (applied at each PoP)
│   ├── NGFW (App-ID, Content-ID, User-ID)
│   ├── URL Filtering (PAN-DB categories)
│   ├── Threat Prevention (IPS, AV, WildFire sandbox)
│   ├── DNS Security
│   ├── SWG (explicit proxy mode)
│   ├── ZTNA 2.0 (private application access)
│   └── CASB (inline + API)
│
├── GlobalProtect (mobile user agent)
│   - Windows, macOS, Linux, iOS, Android
│   - Connects mobile users to nearest compute location
│
├── Remote Networks (branch connectivity)
│   - IPsec tunnels from SD-WAN or routers to compute location
│
└── Service Connections (private app access)
    - IPsec tunnels from data center/cloud VPC to compute location
```

### Management Planes

**Strata Cloud Manager (SCM):** Cloud-native management console for Prisma Access (and newer PAN-OS NGFWs). Recommended for new deployments.

**Panorama:** Traditional PAN-OS management platform. Can manage Prisma Access as a "cloud service plugin." Required for legacy integrations.

**Panorama managed vs. SCM managed:** Choose one management plane per tenant. Panorama and SCM are not used simultaneously for the same Prisma Access tenant.

## ZTNA 2.0

Palo Alto coined "ZTNA 2.0" to differentiate their approach from first-generation ZTNA products.

### ZTNA 1.0 Limitations (What 2.0 Addresses)

**Problem 1 — Allow-and-forget access:**
ZTNA 1.0 products grant access to an application at connection time, then stop evaluating. An attacker who compromises a session has unrestricted access for the session duration.

**ZTNA 2.0 Solution:** Continuous trust verification. Every transaction within an allowed session is re-evaluated against the access policy.

**Problem 2 — Port/protocol-based access (not app-level):**
ZTNA 1.0 grants access to `appserver:443/TCP`. Once connected, the user can access any HTTP resource on that server at that port.

**ZTNA 2.0 Solution:** App-ID-based access. Prisma Access identifies the actual application using PAN-OS App-ID (deep packet inspection). Access policy enforces the specific application, not just port/protocol.

**Problem 3 — No inspection of allowed traffic:**
Most ZTNA products create a tunnel and don't inspect what flows through it — malware, data exfiltration, and C2 traffic are all invisible.

**ZTNA 2.0 Solution:** Content-ID inspection on all allowed traffic. Threat Prevention, WildFire, URL filtering, and DLP apply within the allowed ZTNA session.

**Problem 4 — Supports only web apps (HTTP/S):**
ZTNA 1.0 products typically work only for HTTP/HTTPS applications.

**ZTNA 2.0 Solution:** Supports all ports and protocols (TCP, UDP, ICMP). Covers SSH, RDP, custom TCP applications, VoIP.

### Private Application Access Configuration

**Service Connection:** An IPsec tunnel from the data center or cloud VPC where private applications reside to the nearest Prisma Access compute location.

**Application:**
In Prisma Access policy, define applications using:
1. PAN-OS App-ID (identifies known applications by behavior: ssh, rdp, oracle-db)
2. Custom application (define by IP, port, protocol for unknown apps)

**Access policy (ZTNA 2.0 policy structure):**
```
Security Policy Rule:
  Name: Finance-SAP-Access
  Source: User Group = "Finance-Users"
  Source Device: Device Posture = "Compliant"
  Destination: Application = sap-erp (App-ID)
  Action: Allow
  Profile: ThreatPrevention-Strict (Threat Prevention profile applied to allowed traffic)
  DLP: DLP-Financial-Data (inspect for data exfiltration)
```

**Continuous trust (runtime signals):**
- Device posture profile evaluated at each access attempt and continuously
- User risk signals from Cortex XDR (if integrated): Malware on device → session terminated
- Behavioral signals: Unusual data volume → alert and optionally terminate

### GlobalProtect Agent

GlobalProtect is the endpoint agent for Prisma Access mobile users.

**Connection modes:**
- **Pre-logon:** Connects before user authentication (for machine certificates, domain join)
- **User-logon:** Connects on user authentication (primary mode)
- **On-demand:** User manually connects (less secure; avoid for production)

**Internal vs. external gateways:**
- **External gateway (Prisma Access):** When user is off-network, connect to Prisma Access
- **Internal gateway (optional, on-prem):** When user is on-network, connect to on-prem firewall for internal app access

**Trusted Network Detection:** GlobalProtect detects when the user is on the corporate network and either connects to internal gateway or bypasses (HIP-based configuration).

**Split tunneling:**
```
Prisma Access → GlobalProtect → Split Tunnel
Access Route Include: 10.0.0.0/8 (private ranges → through Prisma Access)
Access Route Exclude: 13.107.0.0/16 (M365 Optimize → direct)
```

**HIP (Host Information Profile):**
GlobalProtect collects host information to enforce posture:
- OS version and patch level
- Disk encryption status
- Antivirus vendor and definition age
- Domain membership
- Running processes (verify EDR agent)
- Certificate presence

HIP data feeds into security policy: Low-risk device → full access; non-compliant device → limited access or blocked.

## Internet Security (SWG and Cloud FWaaS)

### Security Policy on Prisma Access

Prisma Access uses standard PAN-OS security policy rules — familiar to anyone who has managed PAN-OS NGFWs.

**Rule structure:**
```
Source Zone: Trust (internal users)
Source Address: any
Source User: domain\group or individual user
Destination Zone: Untrust (internet)
Destination Address: any
Application: web-browsing, ssl, google-drive (App-ID)
Service: application-default
Action: Allow
Profile Group: Best-Practice (AV, IPS, URL, DNS, WildFire, DLP)
```

**App-ID on Prisma Access:**
Prisma Access uses the same App-ID engine as PAN-OS NGFWs:
- Identifies 3,500+ applications by behavior (not just port/protocol)
- Classifies application risk, category, subcategory, technology
- Update frequency: App-ID content updates weekly

**URL Filtering (PAN-DB):**
PAN-DB is Palo Alto's URL database with 40+ billion URLs across 80+ categories.

Categories for block list: Malware, Phishing, Command-and-Control, Grayware, Proxy-Avoidance-and-Anonymizers
Categories for monitor: Social-networking, Video-streaming, Personal-email

**DNS Security:**
- Blocks DNS queries to malicious/C2 domains
- Detects DNS tunneling (data exfiltration via DNS)
- Uses cloud-based ML for real-time detection of newly registered malicious domains

### Threat Prevention Profiles

**IPS (Intrusion Prevention):**
- Vulnerability protection: Blocks exploit attempts
- Anti-spyware: Blocks C2 communication, spyware downloads
- Wildfire inline: Submits unknown files to WildFire sandbox (blocking mode — holds file during detonation)

**WildFire sandbox:**
- Cloud sandbox shared across all Palo Alto customers (threat intelligence sharing)
- Supports: PE, DLL, Office, PDF, APK, JAR, SWF, archives
- Analysis environments: Windows 7/10, macOS, Linux, Android
- Verdict returned: Benign, Grayware, Malware, Phishing
- Verdicts shared to all WildFire subscribers within minutes

**Best Practice Security Profiles:**
Palo Alto provides "Best Practice" profiles for immediate deployment:
- Vulnerability protection: Block criticals and highs, alert on medium
- Anti-spyware: Block all C2 categories, DNS sinkholing
- URL filtering: Block malware/phishing/C2 categories
- WildFire: Block malicious, alert grayware

## CASB on Prisma Access

### Inline CASB

Inline CASB runs on Prisma Access traffic as it flows through the compute location.

**SaaS application catalog:** App-ID extends to SaaS context — identifies not just "ssl" but "google-drive-upload," "dropbox-personal," "github-enterprise."

**Application controls:**
Policy can enforce:
```
Application: google-drive
Action: Allow (viewing, browsing)
But block: google-drive-upload
```

**Sanctioned vs. unsanctioned:**
- **Sanctioned:** Corporate G Suite / Microsoft 365 — full access
- **Unsanctioned:** Personal Dropbox — allow viewing but block upload and share
- **Unknown:** Not in app catalog — treat as browser traffic, apply URL filtering

**Tenant restrictions:**
For M365, Prisma Access injects tenant restriction headers to enforce corporate tenant access.

### API CASB (SaaS Security Posture Management — SSPM)

Prisma Access API CASB connects to SaaS APIs to:
- Discover sensitive data stored in M365 SharePoint, OneDrive, Google Drive
- Detect overly permissive sharing
- Check SaaS application security configuration (SSPM)
- Remediate: Remove sharing links, move files

**SSPM checks (examples):**
- M365: MFA enforced for all users, conditional access configured, legacy auth blocked
- Salesforce: Password complexity, session settings, audit logging enabled
- GitHub: Branch protection enabled, secret scanning enabled

## ADEM — Autonomous Digital Experience Management

ADEM monitors end-to-end user experience, similar to Zscaler ZDX but built on PAN-OS telemetry.

### Architecture

**Synthetic monitoring:** ADEM runs synthetic transactions from managed endpoints (via GlobalProtect agent) to target applications.

**Metrics monitored:**
- Device health (CPU, memory, WiFi quality)
- Network path (hop-by-hop latency, packet loss, ISP identification)
- Prisma Access PoP performance
- Application response time (per application segment tested)

**Experience Score:** Calculated per-user, per-application (1-100 scale). Aggregated to site, region, and enterprise views.

### Troubleshooting Workflow

**Automated root cause analysis:**
ADEM automatically classifies performance issues:
- "Device-side issue" (high CPU, poor WiFi)
- "Network ISP issue" (ISP latency spike)
- "Prisma Access PoP issue" (processing delay in PoP)
- "Application issue" (server-side slow response)

**ADEM dashboard:**
- Experience score trends over time
- Users with poor experience (bottom 10%)
- Site-level aggregation (identify offices with systemic issues)
- Path visualization (ISP map for each affected user)

## Prisma SD-WAN

Prisma SD-WAN (acquired CloudGenix) is the WAN edge component, completing full SASE.

### SD-WAN Architecture

**ION Devices (CloudGenix ION):** Physical or virtual SD-WAN devices deployed at branch locations.

**Connectivity:**
- **Broadband (ISP 1 + ISP 2):** Active-active or active-standby
- **MPLS:** Can coexist with broadband
- **LTE/5G:** Backup path

**Traffic steering to Prisma Access:**
ION devices automatically steer traffic:
- Internet-bound: Through IPsec tunnel to nearest Prisma Access compute location
- Private app: Through IPsec tunnel to Prisma Access service connection

**Active-active HA:**
ION supports active-active dual ISP:
- Policy-based path selection (use ISP 1 for VoIP, ISP 2 for backup)
- Application SLA policy (route based on latency/jitter requirements of the application)
- Automatic failover: If ISP 1 degrades below threshold, fail over to ISP 2 in < 1 second

### Prisma SD-WAN Integration with Prisma Access

**Single management console:** Both Prisma SD-WAN and Prisma Access managed from Strata Cloud Manager.

**Shared policy:** Application policies defined once in SCM apply across both mobile user access (GlobalProtect) and branch traffic (SD-WAN).

**Benefit:** An application in App-ID with a defined access policy is automatically enforced whether the user is remote (GP) or at a branch (SD-WAN + Prisma Access).

## Administration

### Strata Cloud Manager (SCM)

**Navigation structure:**
- **Manage → Security Policies:** Create and manage firewall rules
- **Manage → ZTNA:** Configured private applications and connectors
- **Manage → Identities:** User-ID configuration, group mappings
- **Manage → Mobile Users:** GlobalProtect gateway and portal configuration
- **Manage → Remote Networks:** Branch IPsec tunnel configuration
- **Monitor → Threats:** Real-time threat logs
- **Monitor → ADEM:** Digital experience dashboard
- **Insights:** AI-assisted policy recommendations, posture scoring

### PAN-OS CLI for Prisma Access Troubleshooting

```bash
# From a Prisma Access compute location (accessed via SCM terminal or Panorama CLI)

# Check GlobalProtect gateway status
show global-protect-gateway statistics

# View active GlobalProtect users
show global-protect-gateway current-user

# Check ZTNA service connection status
show tunnel ipsec

# View security policy hit counts
show running security-policy

# Check WildFire status
show wildfire status

# View URL filtering database version
show url-cloud status
```

### Cortex Data Lake Integration

Prisma Access streams all logs to Cortex Data Lake for long-term retention and analytics.

**Log types:** Traffic, threat, URL, DNS, authentication, GlobalProtect, ADEM

**Retention:** Default 30 days; configurable up to 1 year with additional storage

**Cortex XDR integration:** Prisma Access network telemetry correlates with Cortex XDR endpoint telemetry for unified threat investigation.

## Reference Files

Load for architecture details:

- `references/architecture.md` — Prisma Access compute location architecture, GlobalProtect gateway architecture, ZTNA 2.0 policy engine, Prisma SD-WAN ION device internals, Panorama vs. SCM management, Cortex Data Lake log schema.