Prisma Access Mobile Users with Always-On VPN (GlobalProtect) is the correct choice. It provides persistent, secure connectivity for remote users (on both managed and unmanaged devices) by tunneling all user traffic through the Prisma Access cloud for consistent security inspection and policy enforcement, which aligns with the requirement for inspecting all internet-bound traffic.

SD-WAN integrated with Prisma Access is ideal for branch offices. It provides optimized, resilient connectivity (using dual circuits) and intelligent path selection. Service Connections securely link branches to the private data center, while Local Internet Breakout allows direct, optimized access to SaaS applications from the branch, reducing latency and backhaul.

Prisma Access security policies are enforced at the SPN location. If users in a specific geographic region (EMEA) are not hitting the rule, it’s likely their traffic is being routed to an SPN location that is not included in the scope of that security policy rule. You must ensure the rule includes the SPN locations where the EMEA users connect.

The ‘cloud-storage’ category blocks known, App-ID classified applications. A lesser-known service likely uses non-standard ports or encryption, so its traffic appears as ‘ssl’ or ‘web-browsing’. The most effective method is to create a custom App-ID (an App-ID override) to accurately identify this specific service’s traffic patterns, and then block it in policy.

Prisma Access Service Connections support dynamic routing (BGP). To propagate the acquired network’s route (10.20.0.0/16) to all other sites connected via Prisma Access, you must establish a BGP peer relationship between the on-premises firewall at the acquisition and the Prisma Access Service Connection endpoint. The acquired firewall will then advertise its route via BGP.

For Remote Networks with Local Internet Breakout, traffic originates from a shared branch IP address. To log individual user identity, you must deploy a User-ID agent (or equivalent source like a Windows server with WMI) at the branch to map IP addresses to usernames. This agent must then be configured in the Prisma Access Remote Network settings to send these mappings for identity-aware policy and logging.

Before implementing a potentially complex solution like a new Service Connection or SD-WAN, the correct first step is to use the integrated Digital Experience Monitoring (DEM) tool. DEM can measure the actual latency, jitter, and packet loss for the specific application flow from the user to the data center, helping to pinpoint where the delay is occurring (e.g., last-mile, middle-mile, in the data center) and inform the correct optimization strategy.

The recommended method is to establish a Prisma Access Service Connection directly into the AWS VPC. This creates a private, encrypted tunnel from the Prisma Access cloud to the VPC. Traffic from users (Mobile or Remote Networks) traverses the Prisma Access backbone and enters the VPC privately, never exposing the application to the public internet, while also providing optimal performance within the cloud provider’s network.

The ‘prisma-access’ source object is a special meta-object that represents the egress points of the Prisma Access cloud. Using it as a source in a rule ensures the rule only matches traffic that has been processed through Prisma Access (e.g., from your Mobile Users). Using ‘any’ could inadvertently match direct internet traffic if your public service is exposed, creating a security risk. This allows for clean policy separation.

Prisma Access Mobile Users with Always-On VPN (GlobalProtect) is the correct choice. It provides persistent, secure connectivity for remote users (on both managed and unmanaged devices) by tunneling all user traffic through the Prisma Access cloud for consistent security inspection and policy enforcement, which aligns with the requirement for inspecting all internet-bound traffic.0