5.2 Remote Networks (RN) Onboarding & Branch Routing

5.2 Remote Networks (RN) Onboarding & Branch Routing

Remote Networks Architecture & Customer Premise Equipment (CPE) Integration

Prisma Access Remote Networks (RN) provides a secure, cloud-delivered on-ramp for physical locations—such as branch offices, retail storefronts, healthcare clinics, manufacturing plants, and regional campuses. Instead of maintaining dedicated on-premises firewall clusters, proxy servers, and complex routing hardware at every remote site, organizations deploy standard Customer Premise Equipment (CPE) that establishes route-based IPsec VPN tunnels directly to Prisma Access.

Supported CPE Deployments

Prisma Access is vendor-agnostic and interoperates with any network edge device capable of establishing route-based IPsec tunnels with standard IKEv1 or IKEv2 negotiations:

• Palo Alto Networks PA-Series NGFWs: Managed via Panorama or Strata Cloud Manager, providing seamless policy consistency.
• Prisma SD-WAN ION Devices: Native CloudBlade integration enabling automated tunnel configuration and intelligent application-based path steering.
• Third-Party SD-WAN & Routers: Cisco ISR/ASR/Catalyst, Cisco Meraki, Fortinet FortiGate, Aruba EdgeConnect, Juniper SRX, and generic Linux/VyOS edge routers.

In all deployments, the branch CPE acts as the IKE Initiator, initiating outbound UDP port 500 / 4500 connections across the local public Internet connection to the Prisma Access RN-SPN public IP addresses (IKE Responders).

+-----------------------+                         +-------------------------------------+
| Branch Office Network |                         |       Prisma Access Cloud Region    |
|                       |   Primary IPsec Tunnel  |  +-------------------------------+  |
|  +-----------------+  |========================>|  | Primary RN-SPN Public IP      |  |
|  |   Branch CPE    |  |       (Active Path)     |  +-------------------------------+  |
|  | (Edge Router or |  |                         |                                     |
|  |    PA-Series)   |  |  Secondary IPsec Tunnel |  +-------------------------------+  |
|  +-----------------+  |------------------------>|  | Secondary RN-SPN Public IP    |  |
|                       |      (Standby Path)     |  +-------------------------------+  |
+-----------------------+                         +-------------------------------------+

---

Bandwidth Licensing Models: Per-Location vs. Aggregate Bandwidth

A pivotal evolution in Prisma Access Remote Networks is the licensing and bandwidth provisioning model.

1. Legacy Per-Location Model (Compute Location Bandwidth)

In the legacy model, organizations purchased bandwidth in rigid, committed blocks allocated strictly to specific compute locations:

• Bandwidth was tied permanently to an individual compute location (e.g., 50 Mbps allocated to US West, 100 Mbps allocated to Europe Central).
• Inflexible Utilization: If a retail store in US West experienced low traffic, its unused bandwidth could not be leveraged by a busy office in US East.
• Complex Upgrades: Increasing bandwidth at a site required purchasing additional location licenses and triggering a re-provisioning cycle.

2. Modern Aggregate Bandwidth Model

The modern Aggregate Bandwidth Model decouples bandwidth licensing from physical geography, introducing a unified, pooled capacity model:

• Global or Regional Pooling: Bandwidth is purchased as a total aggregate pool (e.g., 2 Gbps total pool).
• Granular Allocation: Administrators assign bandwidth to individual remote networks in precise 1 Mbps increments (ranging from a minimum of 10 Mbps up to 1000 Mbps per site).
• High Efficiency & Zero Stranded Bandwidth: Unallocated bandwidth remains in the central pool and can be assigned dynamically to expanding sites, new retail branches, or seasonal pop-up locations without license re-purchases.
• Seamless Re-allocation: Modifying bandwidth allocations is an administrative metadata change in Strata Cloud Manager or Panorama that does not tear down active IPsec tunnels or interrupt traffic forwarding.

---

Comparison: Per-Location vs. Aggregate Bandwidth Model

---

IPsec Tunnel Termination Parameters & Crypto Best Practices

Establishing rock-solid, high-performance IPsec tunnels between CPE devices and Prisma Access requires matching cryptographic parameters across Phase 1 (IKE SA) and Phase 2 (IPsec SA).

Phase 1 (IKE SA) Configuration

• Protocol Version: IKEv2 is strongly recommended and represents the modern enterprise standard (RFC 7296). IKEv2 features faster connection establishment, built-in NAT-Traversal, standardized Dead Peer Detection, and superior cryptographic negotiation. IKEv1 (Main Mode) is supported strictly for legacy hardware.
• Encryption Algorithm: aes-256-gcm (Galois/Counter Mode) or aes-256-cbc. AES-256-GCM is preferred as an Authenticated Encryption with Associated Data (AEAD) cipher, providing both high-grade encryption and cryptographic integrity verification in a single hardware-accelerated pass.
• Integrity / Hash: sha256 or sha384 (required when using CBC-mode ciphers; omitted when GCM is selected).
• Diffie-Hellman (DH) Key Exchange: Group 19 (256-bit Random ECP) or Group 20 (384-bit Random ECP) are recommended for optimal security and rapid mathematical computation. Group 14 (2048-bit MODP) is the minimum acceptable baseline. Groups 1, 2, and 5 are cryptographically broken and must never be used.
• Lifetime: Standard lifetime is 28,800 seconds (8 hours).
• Authentication Method: Pre-Shared Key (PSK) with a strong, randomly generated alphanumeric string (minimum 32 characters), or PKI Digital Certificates (X.509).

Phase 2 (IPsec Crypto Profile) Configuration

• Encapsulation Protocol: ESP (Encapsulating Security Payload - IP Protocol 50).
• Encryption Algorithm: aes-256-gcm (preferred) or aes-128-gcm for maximum hardware encryption ASIC throughput.
• Perfect Forward Secrecy (PFS): Must be enabled. PFS ensures that the compromise of a long-term key does not compromise past session keys. Configured with DH Group 19 or Group 14.
• Lifetime: Standard lifetime is 3,600 seconds (1 hour).
• NAT-Traversal (NAT-T): Must be enabled (UDP port 4500). When CPE devices are deployed behind upstream ISP carrier-grade NAT (CGNAT) or broadband modems, NAT-T encapsulates ESP packets within UDP headers, preventing intermediate stateful NAT routers from dropping raw Protocol 50 packets.

---

IPsec Configuration & Crypto Parameter Matrix

---

Primary & Secondary Tunnel Endpoints & High Availability

High availability is engineered natively into every Prisma Access Remote Network onboarding:

1. Dual Public IP Allocation: Upon onboarding a Remote Network, Prisma Access automatically assigns two unique public IPv4 addresses belonging to the selected compute location:
   • Primary Tunnel Endpoint IP
   • Secondary Tunnel Endpoint IP
2. Physical SPN Redundancy: These two public IPs terminate on physically and logically isolated SPN clusters within the hyperscale cloud infrastructure, protecting against single-node maintenance or hardware host failure.
3. CPE Tunnel Configuration: The network engineer configures two logical tunnel interfaces on the branch CPE:
   • tunnel.1 pointing to the Primary IPsec endpoint.
   • tunnel.2 pointing to the Secondary IPsec endpoint.

Deployment Modes: Active/Standby vs. Active/Active (ECMP)

• Active/Standby (Active/Passive): All branch ingress and egress traffic traverses the Primary tunnel during normal operations. The Secondary tunnel remains fully established (IKE SA and IPsec SA active), exchanging BGP keepalive probes in standby. If the Primary tunnel fails, traffic immediately shifts to the Secondary tunnel with sub-second failover.
• Active/Active with ECMP: Both tunnels actively forward traffic simultaneously, load-balancing traffic across dual WAN circuits.

Dead Peer Detection (DPD) & Tunnel Monitoring

To detect dead peer states when underlying ISP transit fails without physical carrier loss, both ends run Dead Peer Detection (DPD):

• Keepalive Interval: Configured to 5 seconds.
• Retry Threshold: 3 missed packets.
• If the CPE misses three consecutive DPD acknowledgments (15 seconds total), it tears down the Phase 1 IKE SA and immediately reroutes traffic across the alternate tunnel.

---

BGP Dynamic Routing Between CPE and Prisma Access RN Nodes

While static routing is supported, dynamic routing using External BGP (eBGP) is the industry standard and strongly recommended for all enterprise Remote Network deployments.

Peering Architecture

• Peering Subnets: An isolated /30 or /31 point-to-point IP subnet is assigned across each tunnel interface (e.g., 169.254.10.0/30 on Primary Tunnel, 169.254.10.4/30 on Secondary Tunnel).
• Autonomous System Numbers (ASN):
  • The branch CPE is assigned a private customer ASN (e.g., 65100).
  • Prisma Access is assigned the tenant ASN (default 65400).
• Dynamic Prefix Exchange:
  • The branch CPE advertises its local LAN subnets (e.g., 10.45.0.0/20) to Prisma Access.
  • Prisma Access advertises corporate subnets (learned from Service Connections), Mobile User pools, and optionally a default route (0.0.0.0/0) if the branch routes all Internet traffic through Prisma Access for cloud-delivered inspection.

Controlling Traffic Symmetry (Avoiding Asymmetric Routing)

Exam Trap Alert: Stateful firewalls will drop return packets if traffic leaves via the Primary tunnel but returns via the Secondary tunnel (causing TCP sequence verification failures). To enforce deterministic, symmetric routing in an Active/Standby topology:

• Outbound Path Selection (Branch to Cloud): Set a higher BGP Local Preference on the branch CPE for routes received over the Primary tunnel (e.g., Local Pref 200 on Primary vs. Local Pref 100 on Secondary).
• Inbound Path Selection (Cloud to Branch): Apply AS Path Prepending on the branch CPE outbound route map toward the Secondary tunnel endpoint. By prepending the local ASN two or three times (e.g., 65100 65100 65100), Prisma Access perceives the Secondary path as longer and directs 100% of return traffic into the Primary tunnel.

                                  PRISMA ACCESS CLOUD
                                           |
               +---------------------------+---------------------------+
               |                                                       |
        Primary RN-SPN                                          Secondary RN-SPN
        Path: AS 65100                                          Path: AS 65100 65100 65100
        (Shorter Path - PREFERRED)                              (Prepended - LONGER)
               ^                                                       ^
               |                                                       |
        Primary Tunnel                                          Secondary Tunnel
        (Local Pref: 200)                                       (Local Pref: 100)
               |                                                       |
               +---------------------------+---------------------------+
                                           |
                                    BRANCH CPE ROUTER
                                        (AS 65100)

---

Equal-Cost Multi-Path (ECMP) Routing Across Dual Tunnels

Organizations utilizing dual active WAN uplinks (e.g., primary fiber internet and secondary commercial broadband) can enable Equal-Cost Multi-Path (ECMP) across dual IPsec tunnels to Prisma Access:

• Prerequisites:
  • Both tunnels must terminate within the same compute location.
  • The CPE must advertise identical AS Path lengths and identical BGP Multi-Exit Discriminator (MED) values over both peerings.
  • ECMP must be explicitly enabled on the Prisma Access Remote Network configuration.
• Flow Distribution: Prisma Access and the CPE distribute traffic across both tunnels using a 5-tuple hash (Source IP, Destination IP, Protocol, Source Port, Destination Port), ensuring per-flow load balancing while keeping individual TCP/UDP sessions on a consistent path.

---

Bandwidth Sizing Calculations & Branch Tier Classification

Prisma Access bandwidth licensing enforces symmetric bidirectional throughput. An allocated bandwidth of 100 Mbps provides 100 Mbps aggregate processing capacity for combined inbound and outbound traffic.

Sizing Calculation Formula

$\text{Required Bandwidth} \ge \text{Peak Concurrency Users} \times \text{Average Throughput per User} \times \text{Overhead Multiplier (1.25)}$

Enterprise Branch Sizing Tiers

---

Quality of Service (QoS) Profiles for Remote Network Egress

When branch traffic egresses the Prisma Access RN-SPN toward the public Internet or corporate data centers, bandwidth saturation can cause packet drops and jitter. Prisma Access enforces Egress QoS Profiles to prioritize mission-critical flows.

The 8 QoS Priority Classes

PAN-OS maps application traffic into 8 distinct QoS priority classes:

• Class 1 (Real-Time Voice): Latency-critical voice traffic (SIP, RTP). Guaranteed committed bandwidth, lowest latency queue.
• Class 2 (Interactive Video): High-priority collaboration tools (Zoom, Microsoft Teams, Cisco Webex).
• Class 3 & Class 4 (Mission-Critical Enterprise SaaS): Core business applications (Salesforce, SAP, Oracle Cloud, NetSuite).
• Class 5 & Class 6 (Standard Business Web & Cloud Collaboration): Email, SharePoint, Google Drive, general intranet browsing.
• Class 7 & Class 8 (Best Effort / Bulk Traffic): Social media, streaming media, personal web surfing, software update downloads.

Guaranteed vs. Maximum Bandwidth Settings

Within each QoS Profile, administrators configure:

• Guaranteed Bandwidth: The minimum throughput reserved for a specific class during periods of link congestion.
• Maximum Bandwidth: The absolute ceiling a class cannot exceed, preventing bulk downloads (Class 8) from monopolizing the branch tunnel.

---

Essential Verification Commands

# Display the active IKE Phase 1 security associations on a branch PA-Series CPE
admin@Branch-CPE> show vpn ike-sa

# Display the active IPsec Phase 2 security associations, byte counters, and lifetimes
admin@Branch-CPE> show vpn ipsec-sa

# Verify BGP neighbor peering state, uptime, and received prefix counts on CPE
admin@Branch-CPE> show routing protocol bgp summary

# Inspect prefixes advertised from the branch CPE out to Prisma Access RN nodes
admin@Branch-CPE> show routing protocol bgp rib-out

# View real-time QoS bandwidth enforcement and drop counters on egress queues
admin@Branch-CPE> show qos interface tunnel.1