The Global Block List, configured under Tenant Settings, is evaluated before Security, Decryption, and Regional Firewall policies. Adding countries here ensures traffic originating from those locations is blocked at the earliest possible stage, providing a consistent and efficient blanket denial without needing complex rule logic in other policy layers.

Configuring a secondary (or backup) Peer IP address in the IKE Gateway object for the Service Connection is key for HA. Prisma Access provides primary and secondary peer IPs for each location. If the tunnel to the primary IP fails, the firewall will automatically attempt to establish a tunnel to the secondary IP, ensuring service continuity without manual intervention.

The most effective and recommended first step for improving App-ID coverage for a known SaaS application is to submit an App-ID request to Palo Alto Networks via the support portal or live community. Their threat research team can analyze the application and develop a proper App-ID, which will then be distributed to all customers via content updates, providing consistent and accurate identification.

The ‘Forwarding to On-Premises Firewall’ option, part of the Corporate Access configuration, is designed for this exact scenario. It ensures that traffic destined for internal corporate IP addresses (defined by the administrator) is routed through the IPSec tunnel from Prisma Access to the on-premises data center, where it can be inspected by the local firewall before reaching the internal servers.

Prisma SD-WAN’s path quality measurement is fundamentally based on Latency and Packet Loss. Thresholds for these metrics (e.g., latency > 200ms, packet loss > 3%) are configured by the administrator to define ‘Good’, ‘Medium’, and ‘Poor’ path states. The system continuously measures these metrics to dynamically steer application traffic to the best available path.

Prisma SaaS Security Inline (specifically its API-based deployment mode) is designed for SaaS application discovery, risk assessment, and security policy enforcement. It connects to APIs of sanctioned SaaS apps (like Microsoft 365, Google Workspace, Salesforce) to provide deep visibility into user activities, data sharing, and configuration risks, which is exactly what the team requires for their report.

For traffic destined to internal/corporate resources, the Corporate Access configuration is paramount. Within it, ‘Access Routes’ define the specific IP subnets that should be tunneled to the on-premises data center. If the subnet of the internal web application is missing or incorrect in the Access Routes list, Prisma Access will not forward the traffic correctly, causing the access failure despite other policies being correct.

This is a fundamental architectural distinction. Remote Network (or Mobile User) Infrastructure is designed to provide security services (firewall, IPS, URL Filtering) to individual users and their devices. Service Connection is designed to connect physical or virtual on-premises firewalls (or other network devices) to the Prisma Access cloud, typically to allow branch offices or data centers to use Prisma Access as their internet gateway or to enable traffic forwarding from mobile users to corporate resources.

For Prisma Access management, Panorama must be deployed on-premises (or in a private cloud/IaaS like AWS VPC) and establish IPsec tunnels to the Prisma Access Service Connections. This provides the secure, reliable management channel needed to push configuration, security policies, and software updates to the cloud firewalls. It does not need to be in the public cloud or a DMZ.

The Global Block List, configured under Tenant Settings, is evaluated before Security, Decryption, and Regional Firewall policies. Adding countries here ensures traffic originating from those locations is blocked at the earliest possible stage, providing a consistent and efficient blanket denial without needing complex rule logic in other policy layers.0