Connecting Prisma Access to your Public Cloud

[KPawlak]

Broadly speaking, there are a few ways to bridge Prisma Access (or a VM/physical firewall for that matter) into your public cloud environment. I will be using AWS as my example by very broadly these ideas still apply.

AWS documents 4 ways to connection via VPN here. We're focused on the S2S use case, which as you can see they reference 2 options - the VGW (Virtual Gateway) and the TGW (Transit Gateway).

VGW

Broadly speaking again, the VGW is a per-VPC resource for connecting an individual VPC to a 'customer gateway' - which in this case would be Prisma Access. This is a straightforward option and we have public documentation on how to do it here. Please note that this documentation is assuming you're onboarding it as a 'Remote Network'. If your Prisma Access deployment is primarily centered around your users working from home / on the road, then you may not have a remote network license. Instead you would onboard this as a 'Service Connection' but the high level workflow is similar on the AWS side.

Limitation of this option: the VGW does not do segmentation within the VPC at L7. You can use Security Groups in AWS to create IP based ACLs for access to certain resources in your VPC, however you will not be able to write a policy to allow a specific user group to have access to a certain EC2 instance using a specific application, so truly achieving a Zero Trust architecture is going to be a challenge. 

You could potentially shore that up by also installing VM-Series firewalls inside this VPC and directing inbound traffic there but that is an extra step.

The other *MAJOR* limitation of this approach is that as of the time of my writing this (March 2021), a VGW drops all traffic destined for an IP not in the VPC it is attached to. So if you have 2+ VPCs, you will need 2+ service connections with this deployment model.

TGW:

The Transit Gateway is a much more scalable approach and is frequently pointed to in our reference architecture guides for AWS. It does take more work to set up but can be a phenomenal tool for linking many VPCs and is also a recommended tool for enabling E-W traffic monitoring and segmentation using the Gateway Load Balancer VM-Series Integration. 

This is much more recommended, does not have the routing limitation I referenced for the VGW above, and can help you insert other use cases moving forward. For organizations that can do so, we recommend going with a TGW based architecture for multiple use cases.

VM-series:

The last option is to directly insert VM-Series firewalls into your VPC and terminate the IPSec tunnel to that/those EC2 instances. This gives you the security benefits and removes the routing / dropping traffic to other VPCs issues of the VGW architecture, but is a bit less effort to set up than the TGW architecture. This is often a good starting point for organizations that will look to deploy the TGW architecture, but are not there yet and want to get the ball rolling on their Prisma Access deployment.