Configuring Prisma Access Remote networks and Service Connections on the same device/site

[DheerajDixit]

Hi everyone, 

I wanted to know what would be the challenges to deploy Service Connection and Remote Networks on the same device/site and what would be the best solution or workaround as per PAN best practices

As per my understanding, if we deploy Service Connection and Remote Networks then, there could be some routing challenges

As a standard config for RN, we have the default route towards the RN tunnel and also a route towards the infrastructure subnet in the RN configuration.

In the Service Connection also we have route towards the service infrastructure

Now when the MU comes to Service connection to access some resources, the return route will be having 2 options RN default route and SVC advertised route

If there is a eg. LDAP request from MU that can use infra subnet and both RN and SVC will have that route causing Asymetric routing issue.

Is it a feasible solution to have SVC and RN on same node/site, if yes what all things are required.

[NikolayDimitrov]

Why not just use Remote network SPN connection if you need firewall capabilities (this is needed if you don't have next generation Firewall in the data center otherwise the service connection is used) for filtering traffic going out of the Data Center ? With Remote Network again the internal DNS servers, Ldap servers and etc that are behind the Remote Network SPN can be accessed by Prisma Access or mobile users or other Remote Network Sites?

Just as an info If you need a service infrastructure/connection because of the mobile users routing you can create a fake one without the ipsec tunnel being up and use the SPN for filtering traffic comming from your DC and allowing traffic to your DC from mobile users or other SPN remote networks for services like internal DNS , LDAP etc.