Can you configure multiple prisma access tunnel end points?

[MichaelMedwid]

I'm new to Prisma but may be able to implement it soon. I understand Global Protect clients send all traffic to the Prisma cloud where the traffic can be inspected to PAN rules. And then I understand that a tunnel can be created from the Prisma cloud to our data center so that the clients with GP can connect to our data center. My question is: can we have two tunnels from the prisma cloud - one to our physical data center and one to our Azure vnets? Or alternatively, if two tunnels are not possible at once - is it quick and easy to change the tunnel termination location e.g. instead of directing all traffic to our data center to change it to a VNG in Azure?

[nikoolayy1 · Accepted solution]

If you can split your local DC and the Azure DC as different subnets then you can make two seperate ceperate subnets and two seperate services then see:

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-ad...

If not even with Prisma/Palo Alto SD-WAN you can't have two tunnel endpoints active at the same sime for a service connection as one will be secondary (maybe the azure dc) if needed you can just dissable the primary or change the tunnel health monitoring to mark it down:

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prepare-the-pris...

Still as I mentioned under your other question check the Prisma Access training if you are going to work with Prisma Access.

[MichaelMedwid]

Very helpful. Thank you!