Zone Based Policy in PANOS SD-WAN (not PRISMA)

JayGee — Tue, 26 Apr 2022 20:37:35 GMT

Hello,

In PANOS SD-WAN (not PRISMA), you must either use predefined zones (zone-to-branch, zone-to-hub, etc.), or you can map pre-existing zones to the predefined zones in Panorama.

Before SD-WAN, using IPSEC tunnels, we could give each tunnel/branch its own zone and control access very easily. Since SD-WAN requires use of predefined zones, it seems line zone-based policy is mostly useless when differentiating between sites, because from the hub's perspective in a hub/spoke topology, every spoke is in the zone-to-branch zone. I could create all of my policies using address objects and apply them via subnet, but it seems weird that normally PA NGFWs are heavily zone-based, and implementing SD-WAN seems to remove zones from the equation almost fully.

Am I missing something here?

Re: Zone Based Policy in PANOS SD-WAN (not PRISMA)

BPry — Tue, 26 Apr 2022 22:35:05 GMT

@JayGee,

At least from my understanding, you aren't missing anything. The feature, at least when I was looking into it, really seemed designed around branch offices that fit a cookie-cutter deployment. As an example, if you were a retail establishment and just had stores connecting to your datacenter. When you don't fit that model, the setup didn't really meet our needs for that.

topic Zone Based Policy in PANOS SD-WAN (not PRISMA) in General Topics

Zone Based Policy in PANOS SD-WAN (not PRISMA)

Re: Zone Based Policy in PANOS SD-WAN (not PRISMA)