Comprehensive and Detailed Explanation

This behavior describes the " Best Available Path " logic inherent in Prisma SD-WAN ' s availability design.

SLA Thresholds: Path Quality Profiles act as filters to identify compliant paths.

Total Violation: If all configured " Active " paths violate the SLA (e.g., Path A has 2% loss, Path B has 5% loss, and the threshold is 1%), the system does not drop the traffic (Option A) because maintaining connectivity is prioritized over perfect quality.

Selection Logic: The system enters a fallback state where it compares the available active paths and selects the " Least Bad " one—the path that is closest to meeting the SLA (in this case, Path A with 2% loss).

Backup Paths: Traffic would only move to a Backup path (Option D) if the policy explicitly configures the backup path to engage upon SLA violation of the active set. However, strictly speaking, if only active paths are considered and all fail, it picks the best of the active group rather than blackholing the traffic.

Comprehensive and Detailed Explanation

When deploying Prisma Access for Remote Networks (connecting branch offices), the licensing and throughput model is based on aggregate bandwidth allocated to specific compute locations (regions).

Bandwidth Allocation (Option D): Administrators must purchase and allocate a specific amount of bandwidth (e.g., 500 Mbps, 1 Gbps) to a Prisma Access " Compute Location " (e.g., US West, Europe Central). This allocated bandwidth is then shared as a pool among all the branch sites (Remote Networks) that onboard and terminate their IPSec tunnels at that specific location. The system does not allocate bandwidth on a strict per-site basis but rather enforces the limit on the aggregate throughput of the compute node itself.

Policy Enforcement (Option A): Security policies for Prisma Access are enforced in the cloud (at the Prisma Access Service Processing Node), not pushed down to the branch ION devices for local enforcement. The ION device handles local segmentation (ZBFW) and traffic steering, but the " Remote Network " security stack resides in the cloud.

Path Usage (Option C): Prisma SD-WAN is designed to utilize Active/Active paths. When a branch has multiple internet circuits connected to Prisma Access, the CloudBlade and ION automatically build tunnels on all compatible paths and can load-balance traffic across them based on application performance (SLA), rather than defaulting to a strict Active/Standby model for internet traffic.

In a Data Center (DC) deployment, the ION device typically peers with a core router via Border Gateway Protocol (BGP) to exchange reachability information between the SD-WAN fabric and the legacy corporate network. 2 When the ION is configured to learn only a default route ($0.0.0.0/0$) from the core, the entire SD-WAN fabric relies on this single BGP-learned route to reach internal resources not directly connected to the ION.

The primary risk in this design is network isolation caused by a BGP misconfiguration or a " soft failure " on the core router. If the BGP session stays " Up " but the core router stops advertising the default route due to a configuration error, the ION device will remove the route from its routing table. Without a valid path to the core, the branch sites connected to the DC ION will lose connectivity to all data center resources.

To mitigate this, the recommended best practice is to add a static default route with a higher Administrative Distance (AD) pointing to the core peer IPs. 3 This acts as a " floating static route. " Under normal operations, the BGP-learned default route (typically with an AD of 20 for eBGP) remains active in the routing table. If the BGP advertisement fails, the static route with the higher AD (e.g., 250) becomes active. This ensures that the ION device maintains a persistent gateway toward the core infrastructure, preventing total fabric isolation and providing a fail-safe mechanism while the BGP peering issue is remediated. While BFD (Option A) helps with fast peer failure detection, it does not solve the issue of a missing prefix advertisement. Static route redundancy provides the necessary architectural " safety net " for the data center ' s reachability.

Prisma SD-WAN simplifies the integration with Prisma Access through a feature known as " CloudBlades, " specifically the Prisma Access for Networks CloudBlade. The " easy onboarding " workflow is designed to automate the complex task of establishing secure tunnels between Branch ION devices and the SASE security processing nodes (SPNs).

When an administrator initiates this process, the system abstracts the manual configuration of IKE and IPSec parameters. Instead of manually defining an IPSec Crypto Profile or an IKE Profile (which are automatically handled by the CloudBlade orchestration), the user must specify where the traffic is going and which physical resources will handle the connection. The Prisma Access Primary Location (Option B) is a mandatory selection because it determines the geographical region and specific compute instance within the Prisma Access cloud that will serve as the primary security gateway for that branch.

Furthermore, the IPSec Termination Node (Option D) must be selected to define the specific endpoint within the Prisma Access infrastructure where the ION device ' s tunnels will terminate. This selection ensures that the Controller can properly orchestrate the site-to-site VPN tunnels, ensuring that the branch traffic is correctly routed to the SASE fabric for security inspection. By selecting these two options, the CloudBlade can automatically negotiate the rest of the tunnel parameters, significantly reducing the potential for human error and accelerating the deployment of a Secure Access Service Edge (SASE) architecture across multiple branch locations.

Comprehensive and Detailed Explanation

To validate specific packet-level details like DSCP (Differentiated Services Code Point) values, header checksums, or exact payload sizes, a Packet Capture (PCAP) is required.

PCAP Tool: Prisma SD-WAN provides a built-in PCAP utility accessible directly from the portal. The engineer can select the specific Interface (e.g., Internet 1), apply a Filter (e.g., port 5060 or host 1.2.3.4), and capture the traffic.

Analysis: The resulting .pcap file can be downloaded and opened in Wireshark. This allows the engineer to definitively see if the packets leaving the ION have DSCP EF (46) and if the packets arriving (if capturing on the other side) still retain that marking, or if the ISP has bleached it to CS0 (0).

Flow Browser (A): While it shows " Application " and metrics, the Flow Browser typically displays the assigned priority class, not necessarily the raw bit-level DSCP value present in the packet header on the wire.

In the Prisma SD-WAN ecosystem, ION (Instant-On Network) devices are categorized based on their performance capabilities, throughput, and their specific role within the network architecture—namely, whether they function as a Branch device or a Data Center (DC) device. 2 The " Branch Gateway " designation typically refers to high-capacity hardware or virtual instances designed to handle complex routing, massive throughput, and high-density connectivity requirements found in large branch offices or regional hubs.

The devices listed in option D represent the high-performance tier of the ION family. The ION 9200 and ION 5200 are flagship hardware appliances designed for large-scale deployments, offering multi-gigabit throughput and extensive port density. 3 The ION 3200 serves as a robust mid-to-high range branch solution. 4 The ION 7116V is a high-capacity virtual appliance (part of the 7000 series) designed to provide flexible, software-defined gateway capabilities in virtualized environments or public clouds (like AWS, Azure, or GCP).

Specifically, these models support advanced features such as Layer 3 hardware forwarding, integrated switching (in certain sub-models), and the processing power required to run deep packet inspection (DPI) for application-based path selection at scale. While smaller units like the 1200 series are excellent for small-to-medium branches, the 9200, 3200, 5200, and 7116V are the primary workhorses for organizations requiring " Gateway " class performance to manage heavy traffic loads and maintain high availability in a Prisma SD-WAN fabric.

In the Prisma SD-WAN architecture, the Controller serves as the centralized management and control plane for the entire fabric. While the Cloud Identity Engine (CIE) is the component responsible for collecting and consolidating user-to-IP mappings from various identity providers (such as Active Directory, Okta, or Azure AD), it does not directly manage the distribution of this operational data to the individual ION devices at the branch level.

Instead, the Prisma SD-WAN Controller integrates with the Cloud Identity Engine to ingest these identity mappings. Once the Controller has synchronized the User-IP and user-group information, it acts as the primary orchestrator. It is responsible for distributing these mappings down to the ION devices across all sites. This distribution ensures that when an ION device sees traffic from a specific source IP, it can accurately associate that traffic with a specific user or group based on the metadata provided by the Controller.

By centralizing this distribution through the Controller, Prisma SD-WAN ensures consistency across the network. Branch ION devices can then apply Application-Based Path Selection and security policies based on user identity rather than just IP addresses. This architectural design offloads the processing requirements of maintaining direct connections to identity providers from the branch hardware, allowing the Controller to handle the heavy lifting of orchestration and global synchronization of identity data.

Comprehensive and Detailed Explanation

To defend against volumetric attacks such as TCP SYN Floods , UDP Floods, or ICMP Floods, Prisma SD-WAN (like PAN-OS) utilizes Zone Protection Profiles .

Function: A Zone Protection Profile is a specific security object designed to screen traffic for protocol anomalies and flood behaviors before it is processed by the complex firewall policy engine. It sets thresholds (e.g., " Max 1000 SYNs/sec " ). If the traffic rate exceeds this threshold, the system triggers an action (Alarm, Drop, or SYN Cookies) to protect the device ' s resources.

Application: Unlike a standard ZBFW Rule (A) which filters based on Source/Destination/App-ID (which might still allow the initial handshake packets that cause the flood), a Zone Protection Profile is applied to the Zone object itself (in this case, the LAN Zone ). This ensures that the flood is mitigated at the ingress stage, preventing the ION ' s session table and CPU from being exhausted by the attack.

Comprehensive and Detailed Explanation

In the Prisma Access architecture (integrated with SD-WAN), distinct connection types serve different purposes.

Remote Networks: These are the connections from your Branch sites (using ION devices) into the cloud. They allow branches to get to the internet or other branches.

Service Connections (SC): This is a specialized high-bandwidth connection used to bridge the Prisma Access Cloud to your Private Data Center or Headquarters.

The primary use case for a Service Connection (Option A) is to allow mobile users and branch users (who are connected to the Prisma cloud) to reach private, centralized resources that still reside on-premise, such as Active Directory controllers, legacy databases, or mainframes. Without a Service Connection, users in the cloud would be able to reach the internet and each other, but not the servers physically located in your HQ data center. The CloudBlade automates the creation of these tunnels, but architecturally, the " Service Connection " is the " cloud-to-HQ " bridge.

Comprehensive and Detailed Explanation

According to Palo Alto Networks Prisma SD-WAN administrator documentation regarding Path Policy configuration, specific rules apply when utilizing Standard VPNs (IPSec tunnels to non-ION devices, such as Prisma Access or third-party firewalls) as an L3 Failure Path .

When a Path Policy rule is configured, the administrator defines Active Paths, Backup Paths, and L3 Failure Paths. The L3 Failure Path is a " last resort " mechanism used when all Active and Backup paths are unavailable (Layer 3 down).

If Standard VPN is selected as the L3 Failure Path type, the system explicitly requires that the administrator also associates it with a specific Standard Services and DC Group within that same policy rule.

The ION device uses the Standard Services and DC Group to identify the specific remote endpoint (tunnel destination) where the traffic should be routed. Unlike a " Direct " (Internet) path which can simply route out to the WAN, a Standard VPN represents a logical tunnel. If the policy rule designates " Standard VPN " as the failure path but leaves the " Standard Services and DC Group " field empty or unselected, the ION effectively has a directive to " use a VPN " but lacks the instruction on which VPN group to use for this specific application context. Consequently, even if the IPSec tunnel to Prisma Access is physically up and stable, the policy engine cannot resolve the next hop for the " SuperSaaSApp " traffic, resulting in the packets being dropped. To resolve this, the administrator must edit the Path Policy rule to ensure the specific Standard Service/DC Group representing Prisma Access is checked/selected for the L3 Failure Path.