Creating an isolated dev environment, is it possible with the PA platform?

[DritanShuta]

We have a dev environment on a different domain that we would like to bring in to our domain. There are plenty of reasons, one being we cannot control the patches, updates or dev access to the machines or control internet access to those machines.

Is it possible to create an isolated environment for DEV purposes using PA? The requirements are very simple, we need to be able to push updates to the machines through SCCM, we need the DEV network to have limited internet access to development tools for updates to SQL, Visual studio etc. Access will only be given to a few developers and the Dev network will be on a separate vLAN. We would also need to movde code from Dev to Test.

I have limited knowlege of PA at this time but going to 3 day training next few months. My understanding from reading on documentation and whitepapers is that the above can be setup and configured if we use the "zone" concept? Is this correct? If so, how many zones do we need to create and what else will we need in order to satisify our developers but at the same time put some controls in place? 

Any feedback would be appriciate it!

Thanks!

[BPry]

You should just need 1 new zone that goes to the Dev computers. Then you simply create security policies that allow them to the 'Untrust' or 'outside' zone to get them internet; then security policies that actually allow you to use the required resources on your actual domain to administer everything. Should be pretty straight forward as you are essentially creating a 'DMZ' with limited access to your internal resources. 

https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/getting-started/configure-interfaces...