Is it possible to specify a source address for certain destinations when using Prisma Access?

MichaelMedwid — Fri, 24 Mar 2023 17:35:19 GMT

Some of our partners or vendors require us to specify a source IP address in order to be able to access their systems on the public Internet. Currently we just make their destination part of our split tunnel destination to our data center PANs and then the traffic takes on that source network IP. Is the same possible when you are using Prisma access?

Re: Is it possible to specify a source address for certain destinations when using Prisma Access?

nikoolayy1 — Mon, 27 Mar 2023 10:02:00 GMT

It is possible to see the source public ip addresses that your traffic will use on the Internet that will be given to you and retrive it API script then you can use it:

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-overview/when-do-ip-addresses-change/compute-locations-and-ip-address-allocation-for-remote-networks

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-overview/retrieve-ip-addresses-for-prisma-access

The prisma access IP addresses can change after time, so see the workaround at:

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-overview/when-do-ip-addresses-change

Also you have the option "Enable Source NAT for Mobile Users—GlobalProtect IP pool addresses, IP addresses in the Infrastructure Subnet, or both." under a Service connection but maybe dissable that so the Data Center can see the real user ip addresses. Check this:

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prepare-the-prisma-access-infrastructure/service-connection-overview/create-a-service-connection

Prisma Acess for now can't insert XFF (X-Forwarded-For) header which will make life easier as then you can use the real ip addresses but it is what it is.

For inbound traffic you can dissable SNAT this way you will see the real client ip addresses.

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-advanced-deployments/prisma-access-remote-network-advanced-deployments/provide-secure-inbound-access-to-remote-network-locations/secure-inbound-access-examples

As you will starting to work with Prisma Access better take the Palo Alto training as to have the needed knowedge or atleast to see the youtube training EDU-118 that is old but still you will have some basic idea:

https://www.youtube.com/results?search_query=Prisma+Access+EDU-118

https://www.youtube.com/watch?v=1mRLEEV3CwM

https://www.youtube.com/watch?v=VX9an7QMGqE

That is it from me 🙂

topic Re: Is it possible to specify a source address for certain destinations when using Prisma Access? in Prisma Access Discussions

Is it possible to specify a source address for certain destinations when using Prisma Access?

Re: Is it possible to specify a source address for certain destinations when using Prisma Access?