SD-WAN EngineerDemo

Prisma SD-WAN Application Acceleration uses Layer 4 and Layer 7 acceleration to improve throughput and application access. Its Layer 4 optimization incorporates device capabilities, network capabilities, application context, and changing network conditions to improve TCP performance and recover throughput more effectively on adverse networks.

Prisma SD-WAN supports three branch deployment modes: Analytics, which monitors traffic without applying policies or path selection; Control, which forwards traffic and applies policies and path selection; and Disabled, which acts only as an in-path link.

Prisma SD-WAN Virtual Routing and Forwarding (VRF) profiles create separate routing domains that allow overlapping IP prefixes to remain isolated. Assigning the appropriate VRF profile to each site preserves that isolation locally and throughout the secure SD-WAN fabric while enabling connectivity within the intended segment.

The Traffic Distribution: Top Applications report provides visibility into application traffic flowing to and from data centers, including the top ingress and egress applications by volume. Viewing the data for the primary data center directly identifies the applications consuming traffic associated with that site.

A violation of configured application-performance or link-quality SLA thresholds triggers the relevant performance incident. Performance policies evaluate application metrics such as RTT and initiation-failure rate, plus link-quality metrics such as latency, loss, and jitter; breached thresholds can produce application or circuit performance-degraded incidents.

Prisma SD-WAN data center clusters determine which data centers communicate with specific branch sites and establish secure VPN connections between DC and branch devices. Separate clusters for each regional DC, with each branch assigned to its matching regional cluster, constrain branch-to-DC tunnels to that region. New branches can likewise be associated with the appropriate DC cluster during site creation.

An MPLS-overlay active path requires an MPLS circuit. A branch that has only internet circuits cannot meet that active-path requirement, even when the policy also defines Prisma Access over the internet as a backup. This mismatch between the configured active MPLS overlay and the branch’s available underlay circuits can prevent a valid return path for traffic arriving through the SD-WAN internet overlay. Prisma SD-WAN path policy rules select paths by both overlay and circuit category, and active paths are preferred before backup paths.

Prisma SD-WAN branch bandwidth tiers are based on the maximum combined ingress and egress bandwidth passing through an ION device. For branch-site licensing, the equivalent measure is the combined ingress and egress bandwidth across the ION devices at that site.

Prisma SD-WAN site templates support bulk deployment using a CSV file of site-specific data, allowing the CMDB data to pre-create consistent configurations for many branches. Device shells pre-stage an ION configuration while the physical device is unavailable; when the ION comes online through an ISP modem or cellular connection, it can be assigned to its shell and receive that configuration. This minimizes field work to physical installation and connectivity, enabling remote cutover support at scale.

In a DC ION HA pair, branches maintain active tunnels to one DC ION and standby tunnels to the other. The standby path activates upon a link or BGP-peer failure at the active DC ION; therefore, a down BGP core peer prevents DC ION-2 from serving as the active VPN endpoint. Palo Alto Networks documents this active/backup behavior in its Host Tracking guidance.

Prisma SD-WAN considers multiple Active paths for normal forwarding and, after other path-selection criteria, chooses the eligible path with the best available bandwidth. Configuring both circuits as Active therefore allows new flows to use the non-saturated circuit. Backup paths and L3 Failure paths are intended for degraded/unavailable and Layer 3 failure conditions, respectively.

Prisma SD-WAN data center clusters determine the data center with which branch sites establish secure VPN connectivity, and each branch is mapped to a single cluster. Creating multiple clusters in each data center and distributing geographically nearby branches across separate clusters limits the blast radius of a cluster failure, reducing regional outages while maintaining a resilient design for access to applications in both data centers.

Prisma SD-WAN Copilot accepts descriptive, context-rich prompts and provides real-time, actionable answers from SD-WAN data. A natural-language query scoped to a branch and time range can summarize the leading bandwidth-consuming source IP addresses and identify the principal applications associated with their usage.

Prisma SD-WAN security zones are enforcement boundaries that can be associated with LAN, WAN, and VPN networks. Zone-based security rules use source and destination zones to allow, deny, or reject application traffic, enabling control of WAN-to-LAN, LAN-to-WAN, and east-west LAN-to-LAN flows within a branch. Prisma SD-WAN ZBFW

A higher-administrative-distance static default route is a floating backup route. It is used when the preferred BGP-learned default route is unavailable, preserving a path to the core and preventing SD-WAN isolation. Prisma SD-WAN supports static routes with configurable administrative distance and selects the lower-distance reachable route first.

Prisma SD-WAN uses SNMP with LLDP to discover IoT devices that are not directly connected to a branch ION. LLDP supplies neighbor information, and the ION uses SNMP MIB queries to retrieve IP and MAC address bindings while crawling neighboring devices. Cisco Discovery Protocol (CDP) is not supported for this discovery, and Syslog is used for log export rather than device discovery.

Prisma SD-WAN uses IP-to-user mappings to apply User-ID security policies for a user or group. A user initiating traffic is matched as the source user on the Branch-1 ION, so source User-ID ZBFW policy can govern both direct internet access and access to a private application within that branch. Destination User-ID rules do not match the initiating user, and Prisma SD-WAN does not support User-ID policies for traffic that originates from or transits through a data center. Remote-branch enforcement, when applicable, uses the username tag carried in site-to-site WAN traffic. ოფიციალური Palo Alto Networks documentation: https://docs.paloaltonetworks.com/prisma-sd-wan/administration/prisma-sd-wan-stacked-policies/add-a-path-policy-rule/configure-user-id-policies

For Prisma SD-WAN branch onboarding to Prisma Access with aggregate bandwidth, the required connectivity selections are the primary Prisma Access location and its IPsec termination node. The location determines the Prisma Access service region, while the termination node provides the tunnel endpoint.

Fail-to-wire and cellular-bypass HA connections preserve access to both WAN circuits for the surviving active ION. The LAN address configuration is identical on both IONs, but only the active ION uses ARP; after takeover, the newly active ION sends gratuitous ARP for SVI addresses so LAN devices update their neighbor mappings. Palo Alto Networks: Configure Branch HA for Devices with Software Cellular Bypass