Prisma Access Security policy enforcement

[S_Williams901]

So I was looking at prisma access content and came across this:

If traffic is initiated from a service connection and bound for a mobile user or a remote network, Prisma Access cannot restrict the traffic. The traffic hits no security-enforcement point, because the RN-SPN and MU-SPNs enforce Security policy only on sessions ingressing into Prisma Access from behind the security processing node. This is not a recommended architecture.

The proper way to control traffic sessions that come out of a service connection is with an on-premises firewall on the network behind the service connection. An on-premises firewall at the data center is the correct way to enforce Security policy for a session initiated by a service connection to a remote network.

when they say firewall on the network behind the service connection, can this be the same palo alto that the service connection terminates to? I would assume so no?

[JayGolf · Accepted solution]

Hi @S_Williams901 ,

Yes! It can be the same palo that the service connection terminates to or another on-premises palo to manage and enforce policies. It really comes down to  Service Connection (SC-CAN) being aimed aimed for HQ or Data Centers where its assumed you already have existing firewalls on-premise or virtually to enforce security.