Select Two (Multi-Select) Questions

Configure Group Mapping Settings in Panorama to retrieve user group memberships from the Cloud Identity Engine.

Group mapping is essential so that Security Policy rules can evaluate and enforce access based on Active Directory group membership.

Configure an Authentication Profile in Panorama that references the Cloud Identity Engine container.

Panorama needs an Authentication Profile mapped to CIE to validate user credentials during GlobalProtect logins.

Enable HIP data collection on the GlobalProtect agent settings.

The GlobalProtect agent must be configured to gather endpoint security posture data (patches, antivirus, disk encryption).

Reference the created HIP Object or Profile within Security policy rules.

Security rules evaluate the collected HIP data against defined profiles to allow or block traffic.

Configure split tunneling to route non-corporate or high-bandwidth web traffic (e.g., video streaming) directly to the internet.

Split tunneling prevents unnecessary backhauling of non-corporate traffic through Prisma Access nodes.

Enable 'Closest Gateway' selection so users automatically connect to the nearest Prisma Access location.

Closest gateway routing minimizes latency by connecting users to the geographically nearest cloud location.

Implement Quality of Service (QoS) policies to prioritize business-critical applications.

QoS ensures that critical traffic receives preferred bandwidth treatment across the cloud path.

Vulnerability Protection profile

Vulnerability protection blocks network-based exploits targeting known software bugs and vulnerabilities.

WildFire Analysis profile

WildFire analyzes unknown files and suspicious payloads in a cloud sandbox to generate real-time signatures.

Configure a Directory Service connector to sync users and groups from Active Directory.

The directory service connector synchronizes organizational units, users, and groups into CIE.

Configure authentication settings and map user attributes within CIE.

Attributes and authentication mappings ensure identities are correctly interpreted by Prisma Access policies.

Link the Cloud Identity Engine tenant to the Prisma Access / Panorama instance.

The CIE tenant must be associated with the Panorama Cloud Services plugin to supply identity data.

Traffic and Threat logs

Traffic and Threat logs record all session establishment details and security inspection verdicts.

HIP Match logs

HIP Match logs provide details on endpoint compliance and posture assessments.

Local ISP latency and bandwidth.

Network performance is a key factor.

Geographic proximity to the mobile user.

Proximity reduces latency.

Available capacity in the compute location.

Capacity ensures traffic can be handled.

Implement dynamic routing protocols (BGP) over the IPsec tunnels to facilitate automatic failover.

BGP allows routers to dynamically adjust paths and switch traffic to secondary tunnels upon link failure.

Deploy dual customer edge routers at the branch location connecting to Prisma Access.

Dual on-premise routers prevent single points of failure at the branch office level.

Configure redundant IPsec tunnels from customer premises equipment (CPE) to diverse Prisma Access gateways.

Configuring multiple IPsec tunnels ensures path resilience if a primary cloud gateway or link fails.

Service health and status of cloud infrastructure and tunnels

Insights displays real-time health and status of nodes and connections.

License consumption and active mobile user counts

License usage and user metrics are tracked in Prisma Access Insights.

Bandwidth utilization and allocation across remote locations

Bandwidth trends and capacity usage are visible in Insights.

Verify that Security Policy rules permit traffic between the respective branch zones

Firewall security policies must allow inter-branch traffic.

Confirm that branch routers are advertising their local subnets via BGP to Prisma Access

Prisma Access must learn branch subnets via BGP to facilitate routing between them.

Ensure 'Branch-to-Branch' routing is enabled in the Prisma Access infrastructure settings in Panorama

Branch-to-branch communication must be explicitly enabled in Panorama configuration.

Source and destination security zones

Security zones (such as remote-network, mobile-user, or trust zones) are fundamental match criteria.

Applications identified via App-ID

Rules can be crafted to allow or block specific applications using Palo Alto Networks App-ID.

User and Group identities via User-ID or CIE

Source users and groups provide granular identity-based policy enforcement.

Verify that the peer public IP address configured in Panorama matches the public IP of the branch office router.

An incorrect peer IP address will prevent the IKE security association from initiating successfully.

Check that IKE Phase 1 and Phase 2 cryptographic proposals (encryption, authentication, DH group) match on both the Prisma Access side and the branch router.

Mismatched crypto proposals will cause Phase 1 or Phase 2 negotiations to fail.

Review Prisma Access Insights to check tunnel status, error logs, and event details.

Prisma Access Insights provides dedicated dashboard views and logs for tunnel states and negotiation failures.

Using source/destination address objects or tags.

Objects allow for granularity in policy matching.

Defining source and destination zones.

Prisma Access is zone-based; traffic matching requires zone definitions.

Add the HIP Profile to the Security Policy rule.

The policy must be linked to the profile.

Enable HIP data collection on the GlobalProtect portal.

Collection must be enabled to receive data.

Create HIP Objects and Profiles in the Panorama object library.

Definitions are required before enforcement.

An identity provider (IdP) integration, such as Azure AD or Okta.

This is the core identity source for CIE.

Enabling the Cloud Identity Engine service in the Prisma Access tenant.

The service must be enabled/configured to function.

URL Filtering with real-time category lookups

URL Filtering inspects web traffic across all mobile users and remote networks.

WildFire cloud-based malware analysis

WildFire analyzes unknown files and provides zero-day protection natively.

Threat Prevention (IPS, Anti-Spyware, and Antivirus)

Threat Prevention is a core security subscription executed on all SPNs.

Geographic distribution of remote users and branch offices

Deploying compute locations close to users minimizes latency.

Data residency and regulatory compliance requirements

Compliance laws often dictate where traffic must be processed and stored.

Proximity to primary SaaS applications and enterprise datacenters

Placing nodes near key applications optimizes traffic routing performance.

To resolve overlapping IP address spaces between multiple branch offices

SNAT translates overlapping private subnets to unique allocated IP pools.

To present a consistent source IP address when branch traffic exits to external SaaS applications

SNAT normalizes outgoing traffic to known Prisma Access public egress IPs.

Connect method (e.g., On-Demand, Always-On)

The connection method is configured within the client settings.

GlobalProtect Gateway preference list

Gateway preferences are assigned via client settings.

Internal DNS server IP addresses

Client settings distribute internal DNS server IPs to connected clients.

Ensure the Autonomous System (AS) numbers match or are correctly configured for external/internal BGP peering.

Mismatched AS numbers prevent BGP session establishment.

Confirm that the CPE is actively advertising the correct IP prefixes to the Prisma Access BGP peer.

If the CPE is not advertising prefixes, Prisma Access cannot learn the routes.

Verify that the BGP peer IP addresses configured on Prisma Access match the CPE peer addresses.

Incorrect peer IP addresses prevent BGP TCP sessions from establishing.