For a remote network location (like a branch office) connecting to Prisma Access, the Service Connection using an IPSec tunnel is the standard and most straightforward deployment method. It establishes a secure tunnel from the on-premises device (like a firewall or router) to the nearest Prisma Access Service Connection node, treating Prisma Access as the secure internet gateway.

Palo Alto Networks firewalls, including Prisma Access, use App-ID technology. If a rule is defined for a specific application like ‘web-browsing’, but a new SaaS application uses a different protocol or signature, it may not be matched by that App-ID. The first step is to verify what application is being identified in the traffic logs. The rule might need to be adjusted to use a broader application (like ‘ssl’) or the specific App-ID for the new SaaS tool if it exists.

To inspect encrypted (HTTPS) web traffic for malware, you must first decrypt it. This requires configuring SSL Forward Proxy (now called Decryption policy in newer PAN-OS) with the appropriate certificates. Once decrypted, the content can be scanned by a security profile, specifically the Anti-Virus profile, which is designed to detect and block malware.

Prisma Access uses a ‘nearest egress’ model for optimal performance. Traffic from mobile users (like the project manager) enters the Prisma Access cloud at the nearest POP. If the destination is a private corporate resource (not public internet), Prisma Access will route the traffic through its secure private backbone to the POP closest to the corporate data center’s Service Connection, then down the IPSec tunnel to the on-premises network.

The ‘Monitor > Assets > Applications’ section in Strata Cloud Manager is designed specifically for this purpose. It provides an overview of all applications seen on the network, allowing you to sort and filter by various metrics, including session count, data volume (bandwidth), and threats. This is the most direct path for an application bandwidth consumption report.

WildFire is Palo Alto Networks’ cloud-based threat analysis service. When enabled in a security profile, unknown or suspicious files are automatically submitted to the WildFire cloud. There, they are detonated in a virtual sandbox environment to analyze their behavior. This process generates new signatures much faster than traditional AV updates, often within minutes, providing protection against zero-day and newly emerging malware.

Prisma Access allows you to use geographic regions (countries) as matching criteria in Security policy rules. Creating a deny rule at the top of the rulebase with the Source set to the list of high-risk countries is the most direct and scalable method. This rule will match any traffic originating from an IP address geolocated in those countries and block it before other, more permissive rules are evaluated.

For Prisma Access Service Connections, dynamic routing (typically BGP) is the recommended method to exchange routes between the customer’s on-premises network and the Prisma Access infrastructure. If the IPSec tunnel is up but the BGP session is not established, Prisma Access does not know which destination networks are behind the remote site, and the remote site does not know how to reach the Prisma Access service networks. This results in no route for the traffic, causing it to be dropped.

The best practice for temporary access is to use policy rules with schedules. You can create a more permissive rule above the restrictive one, but configure its schedule to be active only for the required window (e.g., the next 4 hours). After the schedule expires, the rule becomes inactive, and the underlying deny rule will take effect again. This provides the needed access without manual intervention to remove the rule later, minimizing the risk of a permanent overly permissive rule.

For a remote network location (like a branch office) connecting to Prisma Access, the Service Connection using an IPSec tunnel is the standard and most straightforward deployment method. It establishes a secure tunnel from the on-premises device (like a firewall or router) to the nearest Prisma Access Service Connection node, treating Prisma Access as the secure internet gateway.0