Prisma Access: Foundational Concepts & Architecture

This document provides a detailed overview of the foundational concepts, architecture, licensing, and core components of Palo Alto Networks Prisma Access. Understanding these elements is crucial for effective design, deployment, and management of the solution.

Part 1: What is Prisma Access?

Prisma Access is Palo Alto Networks' cloud-delivered security platform, forming the core of their Secure Access Service Edge (SASE) offering. It converges networking and security functions into a single, globally distributed, cloud-native service designed to protect all application traffic for mobile users and remote networks (branch offices).

How Prisma Access Implements SASE

Prisma Access embodies the SASE principles by providing:

• Converged Security Stack: Integrates best-in-class security services derived from PAN-OS NGFWs:
  • FWaaS: Full Layer 7 threat inspection, App-ID, User-ID, Content-ID.
  • SWG: URL Filtering (including Advanced URL Filtering), SSL Decryption, Threat Prevention (AV, AS, VP), WildFire malware analysis for web traffic. Includes Explicit Proxy support.
  • ZTNA: Leverages GlobalProtect client, User-ID, Device-ID, and Host Information Profile (HIP) checks to provide context-aware, least-privilege access to applications, replacing traditional VPN concentrators.
  • CASB: Provides inline visibility and control over SaaS applications (SaaS Security Inline) and integrates with API-based SaaS Security for data-at-rest scanning (requires separate license/integration).
  • DNS Security: Protects against DNS-based threats using predictive analytics, threat intelligence, and machine learning.
  • Enterprise DLP: Cloud-delivered data loss prevention to detect and prevent exfiltration of sensitive data.
• Cloud-Native & Global: Runs on a global network of secure PoPs managed by Palo Alto Networks, leveraging major public cloud providers (GCP, AWS) for backbone and reach. This ensures scalability and low-latency access for users worldwide.
• Unified Management: Can be managed via the familiar Panorama interface (ideal for existing customers) or through the cloud-native Prisma SASE management console (which also manages Prisma SD-WAN).
• Identity-Driven: Heavily relies on User-ID integration (SAML, LDAP, Kerberos, Cloud Identity Engine) and device posture (HIP) to drive granular policy decisions.

Example Traffic Flow: Mobile User Accessing Internet/SaaS

This sequence diagram illustrates the basic flow when a mobile user connects through Prisma Access to reach a public internet resource or SaaS application.

        sequenceDiagram
            participant MU as Mobile User (GP Client)
            participant PA_PoP as Prisma Access PoP (SPN)
            participant SaaS as Internet / SaaS App

            MU->>PA_PoP: 1. Connect & Authenticate (via GP)
            activate PA_PoP
            Note over MU, PA_PoP: Establish secure tunnel
            MU->>PA_PoP: 2. Request access to SaaS App
            PA_PoP->>PA_PoP: 3. Apply Security Policies (FW, SWG, ZTNA, DLP etc.)
            PA_PoP->>SaaS: 4. Forward allowed traffic
            activate SaaS
            SaaS-->>PA_PoP: 5. Response from SaaS App
            deactivate SaaS
            PA_PoP->>PA_PoP: 6. Inspect return traffic
            PA_PoP-->>MU: 7. Deliver response to User
            deactivate PA_PoP
     

Core Value Proposition

Prisma Access aims to solve the challenges of securing a modern, distributed workforce:

• Consistent Security Everywhere: Applies the same robust security policies and protections to users at headquarters, branch offices, or working remotely/mobile.
• Improved User Experience: Eliminates the need to backhaul traffic through central datacenters for security inspection. Users connect directly to the nearest Prisma Access PoP for faster access to cloud applications (SaaS, IaaS) and the internet.
• Operational Simplicity: Offloads the burden of managing and scaling security infrastructure to Palo Alto Networks. Customers focus on policy, not hardware/software maintenance.
• Scalability and Agility: Cloud-native architecture allows for rapid scaling of capacity based on demand, without requiring hardware procurement.
• Enhanced Security Posture: Provides comprehensive threat protection against modern threats, enforces Zero Trust principles, and improves visibility across all user traffic.

Comparison with Traditional Network Security Architectures

Prisma Access offers significant advantages over legacy approaches:

Part 2: Core Architecture Deep Dive

Understanding the Prisma Access architecture is key to grasping how it delivers secure connectivity. It consists of several interconnected components managed by Palo Alto Networks, interacting with customer-managed elements.

Global Network Infrastructure

Prisma Access is built upon a global network of Points of Presence (PoPs), referred to as **Compute Locations**. These locations host the necessary infrastructure to deliver security services.

• Worldwide Presence: PoPs are strategically located across the globe (North America, South America, Europe, Asia Pacific, Middle East, Africa) to minimize latency for users.
• Public Cloud Backbone: Leverages high-speed backbones of major cloud providers (like Google Cloud Platform and Amazon Web Services) and extensive peering agreements for efficient traffic routing between PoPs and to major SaaS/IaaS destinations.
• Resiliency: Architecture designed for high availability and fault tolerance within and across regions.

Security Processing Nodes (SPNs)

• Function: SPNs are the workhorses of the Prisma Access data plane. They are instances within the compute locations that run the PAN-OS software stack to inspect traffic and enforce security policies (App-ID, Threat Prevention, URL Filtering, User-ID, etc.).
• Global Distribution: SPNs are deployed across all Prisma Access compute locations worldwide.
• Traffic Routing: When a mobile user or remote network connects, Prisma Access directs their traffic to the most optimal SPN(s) based on factors like geographic proximity and latency. Traffic between Prisma Access locations also traverses the global backbone.
• Scalability & Management: Palo Alto Networks manages the deployment, scaling, patching, and lifecycle of the SPNs. Customers do not directly manage individual SPN instances.

Corporate Access Nodes (CANs)

• Role: CANs are specific infrastructure components within the Prisma Access cloud fabric primarily responsible for handling traffic going over **Service Connections** (see Part 3) to the customer's corporate datacenters or headquarters.
• Internal Routing: They act as internal gateways/routers within the Prisma Access service, connecting the SPNs (where user traffic is processed) to the IPSec tunnels established by Service Connections.
• Managed Service: Like SPNs, CANs are part of the Palo Alto Networks managed infrastructure.

Example Traffic Flow: Mobile User Accessing Internal Resource

This sequence diagram shows the path when a mobile user connects through Prisma Access to reach a resource within the corporate network via a Service Connection.

     sequenceDiagram
        participant MU as Mobile User (GP Client)
        participant PA_PoP as Prisma Access PoP (SPN)
        participant PA_CAN as Prisma Access CAN
        participant SC as Service Connection (IPSec)
        participant CorpFW as Corporate Firewall
        participant IntRes as Internal Resource

        MU->>PA_PoP: 1. Connect & Authenticate
        activate PA_PoP
        MU->>PA_PoP: 2. Request access to Internal Resource
        PA_PoP->>PA_PoP: 3. Apply Security Policies (FW, ZTNA, etc.)
        PA_PoP->>PA_CAN: 4. Route traffic destined for Internal Resource
        activate PA_CAN
        PA_CAN->>CorpFW: 5. Encrypt & Send via Service Connection (IPSec Tunnel)
        activate CorpFW
        Note right of PA_CAN: Traffic traverses SC
        CorpFW->>CorpFW: 6. Decrypt & Apply Local Policy
        CorpFW->>IntRes: 7. Forward request to Resource
        activate IntRes
        IntRes-->>CorpFW: 8. Response from Resource
        deactivate IntRes
        CorpFW->>CorpFW: 9. Apply Local Policy
        CorpFW->>PA_CAN: 10. Encrypt & Send response via SC (IPSec Tunnel)
        deactivate CorpFW
        PA_CAN->>PA_PoP: 11. Route response back to SPN
        deactivate PA_CAN
        PA_PoP->>PA_PoP: 12. Apply Security Policies
        PA_PoP-->>MU: 13. Deliver response to User
        deactivate PA_PoP
     

Management Plane Options

Prisma Access offers two primary management paradigms:

        graph TD
            A[Start: Install Cloud Services Plugin] --> B(Configure Cortex Data Lake Connection);
            B --> C{Create/Assign Templates};
            C -- Network/Device Settings --> D(Template Stacks);
            C -- Security/NAT/QoS Policies --> E(Device Groups);
            D --> F[Configure Prisma Access Setup in Plugin];
            E --> F;
            F -- MU/RN/SC Details --> G(Commit to Panorama);
            G --> H(Push Config to Cloud Services Plugin);
            H --> I(Plugin pushes to Prisma Access Cloud);
            I --> J(Monitor Status & Verify Connectivity);
            J --> K[End: Onboarding Complete];
        

Logging Architecture: Cortex Data Lake (CDL)

Centralized logging is fundamental to Prisma Access visibility and reporting.

• Mandatory Integration: Prisma Access **requires** the use of Palo Alto Networks Cortex Data Lake (CDL) for log storage. Logs are not stored persistently on the SPNs themselves.
• Cloud-Based Storage: CDL is a cloud-native, scalable log storage service managed by Palo Alto Networks. Customers purchase storage capacity and retention periods based on their needs.
• Direct Log Streaming: SPNs stream logs directly and securely to the regional CDL instance associated with the customer's Prisma Access deployment. Panorama or the Cloud Management console do *not* proxy logs but are used to *configure* logging settings and view logs stored in CDL.
• Log Types: Comprehensive logs are generated, including: Traffic, Threat (Virus, Spyware, Vulnerability, Wildfire), URL Filtering, User-ID, GlobalProtect (including HIP Match), System, Configuration, Tunnel events, DNS Security, DLP, and more.
• Log Access & Retrieval: Logs stored in CDL can be accessed and queried through:
  • Panorama's ACC (Application Command Center) and Monitor tabs.
  • The Prisma SASE Cloud Management console (including Prisma Access Insights).
  • The Cortex XDR console (if licensed).
  • The Cortex Data Lake App on the Palo Alto Networks Hub.
  • APIs for integration with external systems (e.g., SIEM).
• Log Forwarding (from CDL): While logs reside in CDL, there are options to forward them from CDL to external SIEMs or log management systems using Syslog or HTTP/S event collection mechanisms, configured via the CDL App.

Logging Flow from SPN to CDL

This diagram shows how logs generated during traffic processing are sent to Cortex Data Lake.

graph LR
    A[User Traffic] --> B(Prisma Access SPN);
    B --> C{Policy Enforcement & Log Generation};
    C --> D[Log Stream Secure];
    D --> E(Cortex Data Lake - CDL);
    E --> F((Panorama / Cloud Console / API));
    F --> G[Admin Views Logs/Reports];
    subgraph Prisma Access Cloud
        B
        C
        D
    end
    subgraph Logging & Management
        E
        F
        G
    end

        

IP Address Pools and Planning

Proper IP address management is critical for Prisma Access deployment.

• Prisma Access Infrastructure IPs: Palo Alto Networks allocates specific public IP address blocks for the Prisma Access infrastructure (SPNs, CANs, entry/exit points). These IPs are necessary for routing and security policy configuration on the customer's on-premises firewalls (e.g., allowing IPSec tunnels from these source IPs). These ranges are published in the Prisma Access documentation.
• Mobile User IP Pools: Administrators must define and allocate IP address pools within the Prisma Access configuration (Panorama or Cloud Management). These pools are used to assign IP addresses to GlobalProtect clients when they connect.
  • These pools must be large enough to accommodate the expected number of concurrent mobile users.
  • Typically use RFC1918 private addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x).
• Service Connection & Remote Network Subnets: These refer to the IP address ranges within the customer's own network (datacenters, branches) that need to be reachable *from* Prisma Access. These routes are typically learned by Prisma Access via BGP over the respective tunnels.
• Critical Planning - Avoiding Overlap: It is crucial that the IP address pools assigned to Mobile Users and the internal infrastructure IPs used by Prisma Access do not overlap with any subnets used within the customer's corporate network that need to be accessed via Service Connections or Remote Networks. Overlap will cause routing conflicts and connectivity failures. Careful planning using unique private address space or, in rare cases, non-RFC1918 space for mobile users might be required.

Part 3: Licensing and Bandwidth Models

Prisma Access licensing is primarily based on the number of users and the amount of bandwidth consumed, differing slightly between mobile users and remote networks.

Licensing Units Breakdown

• Mobile Users (MU): Licensed based on the number of unique users connecting via the GlobalProtect client within a given period (typically monthly average). A single user connecting from multiple devices usually counts as one user license. Different license tiers may offer varying features or capacities.
• Remote Networks (RN): Licensed based on the total allocated bandwidth for site-to-site connections.
• Base License: Typically includes core FWaaS, Threat Prevention (standard), User-ID, App-ID, and basic URL Filtering.

Remote Network Bandwidth Options

When licensing bandwidth for Remote Networks, customers typically choose one of two models:

• Bandwidth per Compute Location: A specific amount of bandwidth (e.g., 100 Mbps, 500 Mbps) is allocated to each individual Remote Network site connection onboarded into Prisma Access. This provides predictable bandwidth per site but might be less efficient if usage varies greatly. Minimum bandwidth requirements often apply per tunnel.
• Aggregate Bandwidth Pool: A large pool of bandwidth (e.g., 5 Gbps, 10 Gbps) is purchased and shared dynamically across *all* configured Remote Network connections. This offers flexibility, allowing busy sites to burst beyond individual limits as long as the total aggregate usage remains within the pool limit. It requires monitoring to ensure the aggregate limit is not consistently exceeded.

Mobile User Licensing Details

• Unique User Count: Licensing tracks unique usernames connecting via GlobalProtect. Authentication via SAML/LDAP is key to identifying users.
• Scalability: Purchase licenses based on the expected number of concurrent or active mobile users needing protection.

Add-on Licenses

Beyond the base license, several security services can be added for enhanced protection (availability may depend on MU vs RN context and license bundles):

• Advanced Threat Prevention: Includes enhanced capabilities like blocking unknown C2 traffic inline using ML.
• Advanced URL Filtering: Provides real-time URL analysis using ML, prevention of credential phishing, and more granular web security.
• DNS Security: Subscription for advanced DNS layer protection.
• WildFire Malware Analysis: Cloud-based malware sandboxing service (often included or tiered).
• Enterprise DLP: Cloud-delivered Data Loss Prevention service.
• SaaS Security Inline: Granular visibility and control over specific SaaS applications.
• IoT Security: Specific protection for Internet of Things devices connecting through Prisma Access.
• Cortex Data Lake Log Retention: Longer log retention periods require specific CDL licenses.