https://live.paloaltonetworks.com/t5/prisma-access-articles/optimizing-secure-access-to-private-applications-with-prisma/ta-p/587178 <DIV class="lia-message-template-content-zone"> <H2 class="lia-align-left"><STRONG><FONT color="#000000"><span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="Fig 10_Prisma-Access-Colo-Connect_palo-alto-networks.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/59855i93D485F448912AD6/image-size/large?v=v2&amp;px=999" role="button" title="Fig 10_Prisma-Access-Colo-Connect_palo-alto-networks.png" alt="Fig 10_Prisma-Access-Colo-Connect_palo-alto-networks.png" /></span></FONT></STRONG></H2> <P>&nbsp;</P> <H2 class="lia-align-left"><STRONG><FONT color="#000000">Introduction</FONT></STRONG></H2> <P class="lia-align-left">&nbsp;</P> <P class="lia-align-left">Colocation provides a strategic advantage by allowing enterprises to leverage purpose-built data center infrastructure and technologies without the associated high CAPEX, while also enhancing operational flexibility and reducing risks.</P> <P class="lia-align-left">&nbsp;</P> <P class="lia-align-left">Additionally, colocation can help enterprises reduce latency and improve application performance by having their IT infrastructure closer to the cloud providers, as well as connecting their existing data center infrastructure.</P> <P class="lia-align-left">&nbsp;</P> <P class="lia-align-left">Enterprises who want a reliable and hassle-free solution for designing high-bandwidth, low-latency private connections with seamless Layer 2/3 connectivity from SASE cloud service to their enterprise Colo facilities, look no further than Prisma Access Colo-Connect.</P> <P class="lia-align-left">&nbsp;</P> <P class="lia-align-left">Prisma Access Colo-Connect leverages the cloud native GCP interconnect technology to provide high-bandwidth service connections to enterprises’ private applications with the following capabilities:</P> <P class="lia-align-left">&nbsp;</P> <UL> <LI class="lia-align-left"><STRONG>Up to 20 Gbps High Bandwidth per Region </STRONG></LI> <LI class="lia-align-left"><STRONG>Support </STRONG><A href="https://cloud.google.com/network-connectivity/docs/interconnect#docs" target="_blank" rel="noopener"><STRONG>Dedicated and Partner Interconnects </STRONG></A></LI> <LI class="lia-align-left"><STRONG>Multi VLAN Attachments per Interconnect Link </STRONG></LI> <LI class="lia-align-left"><STRONG>Regional Redundancy&nbsp;</STRONG></LI> </UL> <P>&nbsp;</P> <H3><STRONG>Colo-Connect Use Cases:&nbsp;</STRONG></H3> <H4>&nbsp;</H4> <H4><STRONG>High-Bandwidth Secure Access to Private&nbsp;</STRONG><STRONG>Apps&nbsp;</STRONG></H4> <P><SPAN>A major retail corporation, with an established network presence in a Colo performance hub and a customer of Prisma Access, is planning to consolidate its regional data centers and headquarters. The objective is to establish direct connectivity to their Colo facilities across multiple regions to facilitate high-bandwidth, low-latency secure access to private applications, ensuring 10 Gbps to 20 Gbps throughput for mobile users and those at remote sites.&nbsp;</SPAN></P> <P>&nbsp;</P> <P><SPAN>The corporation sets up Colo-Connect utilizing dedicated or partner interconnects provided by Google Cloud Platform (GCP), which supports up to 20 Gbps throughput per region. This connectivity ensures that high data transfer rates are maintained consistently across all locations.&nbsp;</SPAN></P> <P>&nbsp;</P> <P><SPAN>Since the Colo equipment is peered to the public cloud and the corporation's data center, it can also give access to any private apps hosted in the public cloud with better performance.&nbsp;</SPAN></P> <P>&nbsp;</P> <P><SPAN>Colo-Connect is designed to coexist with the existing Service Connection deployments. This allows the corporation to continue providing access to private applications in smaller data centers that do not require the higher bandwidth. These service connections are managed through Border Gateway Protocol (BGP) routing, ensuring network compatibility between both high and low-bandwidth environments.&nbsp;</SPAN></P> <P>&nbsp;</P> <H4><STRONG>Private Connectivity for Private Applications&nbsp;</STRONG></H4> <P><SPAN>A prominent financial institution, already utilizing Prisma SASE for its cloud-delivered security services. They are also multi-cloud, with GCP, AWS and Azure peering via the Colo hubs. From next year, they are facing new stringent requirements from its global Infosec team. The new mandate stipulates that private application traffic must not traverse the public internet starting next year. Current IPSec tunnels from service connections to their regional colocation (colo)&nbsp;</SPAN><SPAN>hubs and major data centers are not sufficient to meet these security demands.&nbsp;</SPAN></P> <P>&nbsp;</P> <P><SPAN>To adhere to these new security policies and ensure compliance, the institution has decided to deploy Prisma Access Colo-Connect. This design involves establishing a private connection using dedicated or partner interconnects provided by Google Cloud Platform (GCP), which offers up to 20 Gbps of throughput per region. This setup ensures that all traffic is securely dropped directly to their colo racks without passing through the public internet.&nbsp;</SPAN></P> <P>&nbsp;</P> <P><SPAN>In addition, by channeling all private app traffic through Colo-Connect, the institution enhances its security posture, leveraging holistic security services that include Zero Trust Network Access (ZTNA) 2.0. This implementation aligns with the regulatory requirements and meets the stringent internal security policies set by the global Infosec team.&nbsp;</SPAN></P> <P>&nbsp;</P> <H4><STRONG>Third-Party NaaS Provider Integration&nbsp;</STRONG></H4> <P><SPAN>A mid-sized manufacturing company is seeking to enhance its network infrastructure by integrating third-party Network as a Service (NaaS) solutions such as Megaport and PacketFabric. The goal is to establish seamless, high-bandwidth connectivity between the company's colocation (colo) facilities and its cloud-based applications, including SaaS platforms like Salesforce.com and Box.&nbsp;</SPAN></P> <P>&nbsp;</P> <P><SPAN>The company utilizes networking equipment provided by a NaaS provider, configured as a hub within the regional data centers. This hub acts as the central point for routing traffic between the company’s users and their applications hosted in public cloud Virtual Private Clouds (VPCs) or directly with SaaS providers.&nbsp;</SPAN></P> <P>&nbsp;</P> <P><SPAN>To ensure secure and efficient routing, the company establishes Border Gateway Protocol (BGP) sessions between the NaaS provider’s networking equipment and Prisma Access Colo-connect. This setup provides a robust security layer and enhances the connectivity to cloud services.&nbsp;</SPAN></P> <P>&nbsp;</P> <P><SPAN>The integration with Prisma Access Colo-Connect ensures that all data transmitted between the colo, cloud services, and SaaS applications remains secure, meeting stringent compliance requirements.&nbsp;</SPAN></P> <P>&nbsp;</P> <H2><FONT color="#000000"><STRONG>A Deployment Journey</STRONG></FONT></H2> <P>&nbsp;</P> <H4><STRONG>To begin the Colo-Connect deployment&nbsp;</STRONG></H4> <TABLE border="1" width="100%"> <TBODY> <TR> <TD width="50%"><STRONG>Ensuring access to the Colo facility provider</STRONG></TD> <TD width="50%"><SPAN>For example, customers will need access to the Equinix Customer Portal</SPAN></TD> </TR> <TR> <TD width="50%"><STRONG>Involving accountable teams in the design process</STRONG></TD> <TD width="50%"> <P><SPAN>Security, Networking,&nbsp;</SPAN><SPAN>Facility and Colo teams&nbsp;</SPAN><SPAN>might need to deploy&nbsp;</SPAN><SPAN>Colo-Connect jointly.</SPAN></P> </TD> </TR> <TR> <TD width="50%"><STRONG>Checking GRE and BGP is supported on CPE</STRONG></TD> <TD width="50%"> <P><SPAN>Colo-Connect service&nbsp;</SPAN><SPAN>connections use GRE&nbsp;</SPAN><SPAN>tunnels as overlay</SPAN></P> </TD> </TR> <TR> <TD width="50%"> <P><STRONG>Determining between <U><FONT color="#3366FF"><A href="https://cloud.google.com/network-connectivity/docs/interconnect#docs" target="_blank" rel="noopener">GCP partner or dedicated interconnect</A></FONT></U> based on business and project&nbsp;</STRONG><STRONG>requirements</STRONG></P> </TD> <TD width="50%"> <P><A href="https://cloud.google.com/network-connectivity/docs/interconnect/concepts/partner-overview" target="_blank" rel="noopener"><FONT color="#0000FF"><STRONG><FONT color="#3366FF"><U>Partner Interconnect</U></FONT></STRONG></FONT></A><SPAN><FONT color="#3366FF"><U><STRONG><A href="https://cloud.google.com/network-connectivity/docs/interconnect/concepts/partner-overview" target="_blank" rel="noopener">:</A></STRONG></U><STRONG>&nbsp;</STRONG></FONT>A pairing key from Prisma Access is required for&nbsp;</SPAN><SPAN>partner interconnects. You receive this key during&nbsp;</SPAN><SPAN>Prisma Access onboarding. If you create a partner&nbsp;</SPAN></P> <P><SPAN>interconnect, make sure that the service provider (SP) is a </SPAN><U><FONT color="#3366FF"><STRONG><A href="https://cloud.google.com/network-connectivity/docs/interconnect/concepts/service-providers" target="_blank" rel="noopener">supported service provider</A></STRONG></FONT></U>&nbsp;<SPAN>with GCP and the connectivity between the SP and GCP is already&nbsp;</SPAN></P> <P><SPAN>established.</SPAN></P> <P>&nbsp;</P> <P><A href="https://cloud.google.com/network-connectivity/docs/interconnect/concepts/dedicated-overview" target="_blank" rel="noopener"><SPAN><STRONG><FONT color="#3366FF"><U>Dedicated Interconnect</U></FONT></STRONG></SPAN></A><SPAN><FONT color="#3366FF"><U><STRONG><A href="https://cloud.google.com/network-connectivity/docs/interconnect/concepts/dedicated-overview" target="_blank" rel="noopener">:</A></STRONG></U></FONT> Determine the location of the Colo where the&nbsp;</SPAN><SPAN>cross-connect cable will be connected before you begin onboarding in Prisma&nbsp;</SPAN><SPAN>Access. The Colo location is required for Palo Alto&nbsp;</SPAN><SPAN>Networks to order the&nbsp;</SPAN><SPAN>dedicated link.&nbsp;</SPAN></P> <P><SPAN>Be familiar with the basic network interconnections to configure the circuits. Upon provisioning the dedicated interconnect and receiving ebgp information from GCP, customers need to&nbsp;configure the ebgp over the dedicated interconnect vlan first and test the underlay connectivity.</SPAN></P> </TD> </TR> </TBODY> </TABLE> <H4>&nbsp;</H4> <H4><STRONG>Understand the licensing and billing:&nbsp;</STRONG></H4> <P><SPAN>There are two types of costs accrue to Prisma Access Colo Connect customer:</SPAN></P> <P>&nbsp;</P> <UL> <LI><SPAN>Prisma Access </SPAN><STRONG><I>Colo-Connect </I></STRONG><SPAN>and&nbsp;</SPAN><STRONG style="font-family: inherit;"><I>Service-Connection </I></STRONG><SPAN>licenses&nbsp;</SPAN></LI> </UL> <UL> <LI><SPAN>Existing bills from customers’ Colo providers, such as rack space, power, connectivity, smart hands and so on.&nbsp;</SPAN></LI> </UL> <P>&nbsp;</P> <P><SPAN>GCP Interconnect charges accrue to Prisma Access that owns the VLAN attachment. Customers are not billed extra and don’t need to deal with GCP in order to provision interconnect links under their titles.&nbsp;</SPAN></P> <P>&nbsp;</P> <P><SPAN>In the case of deployment requiring more than 16 connections, or any GCP related issues, customers contact Palo Alto Networks representative, and the Prisma Access team will engage with GCP.&nbsp;</SPAN></P> <P>&nbsp;</P> <P><SPAN>Below table explains Prisma Access Colo-Connect and Service-Connection licensing:&nbsp;</SPAN></P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="Fig 2_Prisma-Access-Colo-Connect_palo-alto-networks.png" style="width: 368px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/59845iEFC07CA4855086E7/image-dimensions/368x515?v=v2" width="368" height="515" role="button" title="Fig 2_Prisma-Access-Colo-Connect_palo-alto-networks.png" alt="Fig 2_Prisma-Access-Colo-Connect_palo-alto-networks.png" /></span></P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="Fig 3_Prisma-Access-Colo-Connect_palo-alto-networks.png" style="width: 500px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/59846i1B9E7F42383C9D23/image-dimensions/500x170?v=v2" width="500" height="170" role="button" title="Fig 3_Prisma-Access-Colo-Connect_palo-alto-networks.png" alt="Fig 3_Prisma-Access-Colo-Connect_palo-alto-networks.png" /></span></P> <P>&nbsp;</P> <P>&nbsp;</P> <H4><STRONG>Interoperability with regular service connection (SC-CAN)&nbsp;</STRONG></H4> <P><SPAN>For customers already deployed IPSec-Based Service Connections, it is recommended to deploy Colo-Connect and IPSec tunnel-based service connections in different regions, since there was limited support to rebalance Mobile User Security&nbsp;</SPAN></P> <P><SPAN>Process Node</SPAN><STRONG>(</STRONG><STRONG><I>MU-SPN) </I></STRONG><SPAN>peering with </SPAN><STRONG><I>SC-CAN </I></STRONG><SPAN>and </SPAN><STRONG><I>Colo-SC</I></STRONG><SPAN>.&nbsp;</SPAN></P> <P>&nbsp;</P> <P><SPAN>From Prisma Access 5.1, Colo-SC will gain additional preference compared to regular SC so that MU-SPN will rebalance with Colo-SC in the same region according to bandwidth weight.</SPAN></P> <P>&nbsp;</P> <P><SPAN><span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="Fig 4_Prisma-Access-Colo-Connect_palo-alto-networks.png" style="width: 477px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/59847i2D0F8EAB4E200DA1/image-dimensions/477x326?v=v2" width="477" height="326" role="button" title="Fig 4_Prisma-Access-Colo-Connect_palo-alto-networks.png" alt="Fig 4_Prisma-Access-Colo-Connect_palo-alto-networks.png" /></span></SPAN></P> <H4><SPAN><STRONG>High Level Configuration Workflow</STRONG></SPAN></H4> <P><SPAN><span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="Fig 5_Prisma-Access-Colo-Connect_palo-alto-networks.png" style="width: 490px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/59848iF01188F61BE634E7/image-dimensions/490x458?v=v2" width="490" height="458" role="button" title="Fig 5_Prisma-Access-Colo-Connect_palo-alto-networks.png" alt="Fig 5_Prisma-Access-Colo-Connect_palo-alto-networks.png" /></span></SPAN></P> <P><SPAN><span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="Fig 6_Prisma-Access-Colo-Connect_palo-alto-networks.png" style="width: 865px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/59850i391F5D6E9B7BBF17/image-dimensions/865x533?v=v2" width="865" height="533" role="button" title="Fig 6_Prisma-Access-Colo-Connect_palo-alto-networks.png" alt="Fig 6_Prisma-Access-Colo-Connect_palo-alto-networks.png" /></span><A href="https://docs.paloaltonetworks.com/prisma-access/administration/colo-connect-in-prisma-access/configure-prisma-access-colo-connect" target="_blank" rel="noopener"><span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="Fig 7_Prisma-Access-Colo-Connect_palo-alto-networks.png" style="width: 866px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/59853iDE7CCF9EC20951EB/image-dimensions/866x1029?v=v2" width="866" height="1029" role="button" title="Fig 7_Prisma-Access-Colo-Connect_palo-alto-networks.png" alt="Fig 7_Prisma-Access-Colo-Connect_palo-alto-networks.png" /></span></A></SPAN></P> <P><A href="https://docs.paloaltonetworks.com/prisma-access/administration/colo-connect-in-prisma-access/configure-prisma-access-colo-connect" target="_blank" rel="noopener"><span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="Fig 8_Prisma-Access-Colo-Connect_palo-alto-networks.png" style="width: 866px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/59852iE29C0D6F6C81BFF2/image-dimensions/866x108?v=v2" width="866" height="108" role="button" title="Fig 8_Prisma-Access-Colo-Connect_palo-alto-networks.png" alt="Fig 8_Prisma-Access-Colo-Connect_palo-alto-networks.png" /></span></A></P> <P>&nbsp;</P> <H2><FONT color="#000000"><STRONG>Appendix and References&nbsp;</STRONG></FONT></H2> <P>&nbsp;</P> <P><STRONG><A href="https://docs.paloaltonetworks.com/prisma-access/administration/colo-connect-in-prisma-access/configure-prisma-access-colo-connect" target="_blank" rel="noopener">Prisma Access Colo-Connect Admin Guide</A>&nbsp;</STRONG></P> <P>&nbsp;</P> <H4><STRONG>Supported Prisma Access locations for Colo-Connect and GCP region mapping</STRONG></H4> <span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="Fig 9_Prisma-Access-Colo-Connect_palo-alto-networks.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/59854iEAC70328EDFE51D7/image-size/large?v=v2&amp;px=999" role="button" title="Fig 9_Prisma-Access-Colo-Connect_palo-alto-networks.png" alt="Fig 9_Prisma-Access-Colo-Connect_palo-alto-networks.png" /></span> <P>&nbsp;</P> <P>&nbsp;</P> </DIV> Fri, 17 May 2024 22:08:07 GMT kshahzad 2024-05-17T22:08:07Z https://live.paloaltonetworks.com/t5/prisma-access-articles/optimizing-secure-access-to-private-applications-with-prisma/ta-p/587178 <P>Colocation provides a strategic advantage by allowing enterprises to leverage purpose-built data center infrastructure and technologies without the associated high CAPEX, while also enhancing operational flexibility and reducing risks.</P> Fri, 17 May 2024 22:08:07 GMT https://live.paloaltonetworks.com/t5/prisma-access-articles/optimizing-secure-access-to-private-applications-with-prisma/ta-p/587178 kshahzad 2024-05-17T22:08:07Z