topic Re: Prisma direct access to Azure in General Topics

Prisma direct access to Azure

ohareka — Sun, 05 Feb 2023 20:23:56 GMT

Hello,

I connect from home via Prisma to on-prem. I have a few domain controllers setup for pre-logon etc.

- what if my domain controllers were all offline or the firewall was offline

- can i have a domain controller in Azure

I have setup a site to site VPN from Azure to my firewall and can copy data across but dont know yet how to get my Prisma IP range to talk to it.

Should i be concerned about tromboning (latency) if i did get the Prisma clients talking to Azure

or should i be looking at something that allows Prisma to talk direct to Azure

any links to documents are welcome

thanks

Re: Prisma direct access to Azure

reaper — Wed, 08 Feb 2023 12:21:55 GMT

I assume you're talking about prims access?

Are you currently using LDAP for authentication? If the SC connection is broken, or the ADs were to crash you will no longer be able to logon.

You could consider switching to SAML which should be a little more resilient to failure (and as additional redundancy you could consider setting up a secondary portal, new feature in plugin 3.2.1, to still have LDAP available in case the SAML IdP were to die).

You can set up an SC to your azure environment but ADS doesn't work with LDAP authentication so you'd need to switch to SAML anyway

Re: Prisma direct access to Azure

ohareka — Thu, 09 Feb 2023 21:50:24 GMT

yes - i am using Prisma access via Global Protect to connect from home for remote access. I am using LDAP. I have created a domain controller in the cloud and the Azure connection where it is hosted in the cloud has a site to site with my work Palo Alto fw. Is their a way i can connect from prisma direct to the Azure cloud connection without tromboning into my network. ie is their some sort of prisma express route into azure

Re: Prisma direct access to Azure

nikoolayy1 — Tue, 09 May 2023 07:31:14 GMT

Also except SAML with the cloud identity engine SCIM is also an option and for on-prem AD the CIE has an agent:

https://docs.paloaltonetworks.com/cloud-identity/cloud-identity-engine-getting-started/choose-directory-type/configure-an-on-premises-directory

https://docs.paloaltonetworks.com/cloud-identity/cloud-identity-engine-getting-started/choose-directory-type/configure-a-cloud-based-directory