Prisma Access routing between tenants ?

nikoolayy1 — Fri, 04 Nov 2022 13:10:07 GMT

Hello to All,

After reading much about this I am starting to think that internal routing between the Prisma Access tenants is not possible and the traffic should be send with Traffic Steering to a router that is on-prem and connected to the two tenants or use use a dedicated service connection with the traffic stearing but then the two tenants will talk with one another through the external Prisma Access public Ip addresses and not the internal ones.

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-advanced-deployments/service-connection-advanced-deployments/use-traffic-forwarding-rules-with-service-connections

I could be wrong but this seems the only way but this is a little limiting as for example to stop SIP ALG function of the SIP application is done with per device group and for a prisma access only one device group is used so this can't be stopped for a just single Remote Network connection.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEsCAK

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/app-id/disable-the-sip-application-level-gateway-alg

topic Prisma Access routing between tenants ? in Prisma Access Discussions

Prisma Access routing between tenants ?