topic Re: Prisma Access as a Replacement for GlobalProtect and Security Inspection Platform – Seeking Real-World Feedback in Prisma Access Discussions

Prisma Access as a Replacement for GlobalProtect and Security Inspection Platform – Seeking Real-World Feedback

alirezabtf — Mon, 28 Sep 2026 14:23:58 GMT

Hello Everyone,

We are currently evaluating Prisma Access as a replacement for our traditional GlobalProtect deployment and are considering using Prisma Access as our primary cloud-delivered security platform for remote users.

Our goal is to leverage the full security stack, including:

URL Filtering
WildFire
DNS Security
Advanced Threat Prevention
DLP
SSL Decryption
SaaS Visibility and Control
User and Application Visibility

For organizations that have already made this transition, I would appreciate hearing about your experience.

Some questions we have are:

Have you encountered any issues or unexpected challenges after moving to Prisma Access?
Are you able to perform all required security inspections successfully?
Do you feel you have the same level of visibility as you had with on-premises Palo Alto firewalls?
Have you experienced any visibility gaps, blind spots, or troubleshooting challenges?
How effective are the logging, monitoring, and reporting capabilities?
Have you had any concerns related to SSL decryption, DLP, or user experience?
Have you noticed any increase in latency, application slowness, or performance issues after directing traffic through Prisma Access for inspection?
Were there any applications or services that required special handling or exceptions to maintain acceptable performance
We are particularly interested in understanding whether organizations have been able to achieve full inspection and maintain complete visibility after moving security services to Prisma Access.

Any feedback, concerns, recommendations, or lessons learned would be greatly appreciated.

Thank you in advance for sharing your experience.

Re: Prisma Access as a Replacement for GlobalProtect and Security Inspection Platform – Seeking Real-World Feedback

ronald59pepper — Thu, 01 Oct 2026 10:17:18 GMT

Transitioning from traditional GlobalProtect to Prisma Access generally delivers robust security parity and excellent cloud scalability, but most organizations encounter initial hurdles with SSL decryption overhead, complex troubleshooting across remote nodes, and occasional latency spikes requiring strategic traffic steering (such as local breakout for trusted SaaS apps like Zoom or Microsoft 365). While you achieve the same comprehensive visibility and full stack inspection as on-prem Palo Alto firewalls, success heavily depends on properly sizing remote networks, fine-tuning decryption policies to avoid user friction, and leveraging tools like Prisma Access Insights for effective log monitoring.

Re: Prisma Access as a Replacement for GlobalProtect and Security Inspection Platform – Seeking Real-World Feedback

kiwi — Mon, 05 Oct 2026 14:11:15 GMT

Hi @alirezabtf ,

Building on the points above, here are a few additional technical considerations and best practices based on real-world migrations from on-premises GlobalProtect to Prisma Access:

1. Security & Feature Parity

Because Prisma Access runs native PAN-OS under the hood, you get full inspection parity for WildFire, Advanced Threat Prevention, Advanced URL Filtering, and DNS Security.

SSL Decryption & Enterprise DLP: Capabilities match on-prem firewalls, but you will want to review your decryption bypass lists early. Decrypting heavily pinned or certificate-bound applications will require fine-tuning your SSL profiles in Panorama or Strata Cloud Manager.

2. Performance & Optimization

SaaS Optimization / Traffic Steering: For real-time media applications (Microsoft 365, Teams, Zoom), leverage Split Tunneling / SaaS Direct Breakout. Hairpinning high-volume UDP video/audio streams through full SSL inspection often introduces artificial latency and degrades user experience.
Egress IP Whitelisting: Because Prisma Access uses dynamic cloud egress nodes, third-party SaaS vendors that mandate static source IP whitelisting will require you to assign Dedicated Egress IPs in Prisma Access or route that specific traffic back through a Service Connection.

3. Visibility & Troubleshooting

Logging: All logs stream natively to Strata Logging Service (SLS), giving you unified User-ID, App-ID, and Threat visibility across all remote endpoints.
Autonomous DEM (ADEM): On-prem firewalls rely on local interface statistics, but Prisma Access relies heavily on Prisma Access Insights (PAI) and ADEM. ADEM is particularly critical—it provides synthetic hop-by-hop telemetry from the client endpoint, through the GlobalProtect app, across the Prisma Cloud node, and out to the target application.

4. Key Architectural Considerations

Service Connections: Ensure adequate bandwidth is allocated to your Service Connections (the IPSec tunnels connecting Prisma Access back to your corporate datacenters/HQ).
Cloud Identity Engine (CIE): Deploy CIE early to handle User-ID and group mapping seamlessly in the cloud without relying on on-prem Domain Controller log forwarding.

I hope these provide more insights.

Kind regards,

Re: Prisma Access as a Replacement for GlobalProtect and Security Inspection Platform – Seeking Real-World Feedback

alirezabtf — Mon, 05 Oct 2026 20:12:42 GMT

Thanks a lot for clear explanation
Are we able to do the split tunnel for our zoom and teams call for minimize the latency

Re: Prisma Access as a Replacement for GlobalProtect and Security Inspection Platform – Seeking Real-World Feedback

kiwi — Tue, 06 Oct 2026 08:24:30 GMT

Hi @alirezabtf ,

Yes you can. Under Network > GlobalProtect > Gateways > <gateway-config> > Agent > <agent-config> > Client Settings > Split Tunnel

Add the complete path of each application process for which you want to exclude the traffic from your VPN tunnel. These applications are sent through the physical adapter on endpoints rather than the virtual adapter (the tunnel). You can add up to 200 entries to the list.

For example, to exclude traffic from the RingCentral application:

For Windows endpoints, add %AppData%\Local\RingCentral\SoftPhoneApp\Softphone.exe and %AppData%\Local\RingCentral\SoftPhoneApp\SoftphoneMapiBridge.exe
For macOS endpoints, add /Applications/RignCentral for Mac.app/Contents/MacOS/Softphone

If you do not enable split tunneling, every request is routed through the tunnel.

Hope this helps,