Prisma direct access to Azure

[ohareka]

Hello,

I connect from home via Prisma to on-prem.  I have a few domain controllers setup for pre-logon etc.

- what if my domain controllers were all offline or the firewall was offline

- can i have a domain controller in Azure 

I have setup a site to site VPN from Azure to my firewall and can copy data across but dont know yet how to get my Prisma IP range to talk to it.

Should i be concerned about tromboning (latency) if i did get the Prisma clients talking to Azure

or should i be looking at something that allows Prisma to talk direct to Azure 

any links to documents are welcome 

thanks 

[reaper · Accepted solution]

I assume you're talking about prims access?

Are you currently using LDAP for authentication? If the SC connection is broken, or the ADs were to crash you will no longer be able to logon.

You could consider switching to SAML which should be a little more resilient to failure (and as additional redundancy you could consider setting up a secondary portal, new feature in plugin 3.2.1, to still have LDAP available in case the SAML IdP were to die). 

You can set up an SC to your azure environment but ADS doesn't work with LDAP authentication so you'd need to switch to SAML anyway

[ohareka]

yes - i am using Prisma access via Global Protect to connect from home for remote access.  I am using LDAP.  I have created a domain controller in the cloud and the Azure connection where it is hosted in the cloud has a site to site with my work Palo Alto fw.  Is their a way i can connect from prisma direct to the Azure cloud connection without tromboning into my network. ie is their some sort of prisma express route into azure 

[nikoolayy1]

Also except SAML with the cloud identity engine SCIM is also an option and for on-prem AD the CIE has an agent:

https://docs.paloaltonetworks.com/cloud-identity/cloud-identity-engine-getting-started/choose-direct...

https://docs.paloaltonetworks.com/cloud-identity/cloud-identity-engine-getting-started/choose-direct...