Connecting Prisma Access to your Public Cloud

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Connecting Prisma Access to your Public Cloud

L1 Bithead

Broadly speaking, there are a few ways to bridge Prisma Access (or a VM/physical firewall for that matter) into your public cloud environment. I will be using AWS as my example by very broadly these ideas still apply.


AWS documents 4 ways to connection via VPN here. We're focused on the S2S use case, which as you can see they reference 2 options - the VGW (Virtual Gateway) and the TGW (Transit Gateway).



Broadly speaking again, the VGW is a per-VPC resource for connecting an individual VPC to a 'customer gateway' - which in this case would be Prisma Access. This is a straightforward option and we have public documentation on how to do it here. Please note that this documentation is assuming you're onboarding it as a 'Remote Network'. If your Prisma Access deployment is primarily centered around your users working from home / on the road, then you may not have a remote network license. Instead you would onboard this as a 'Service Connection' but the high level workflow is similar on the AWS side.


Limitation of this option: the VGW does not do segmentation within the VPC at L7. You can use Security Groups in AWS to create IP based ACLs for access to certain resources in your VPC, however you will not be able to write a policy to allow a specific user group to have access to a certain EC2 instance using a specific application, so truly achieving a Zero Trust architecture is going to be a challenge. 


You could potentially shore that up by also installing VM-Series firewalls inside this VPC and directing inbound traffic there but that is an extra step.


The other *MAJOR* limitation of this approach is that as of the time of my writing this (March 2021), a VGW drops all traffic destined for an IP not in the VPC it is attached to. So if you have 2+ VPCs, you will need 2+ service connections with this deployment model.




The Transit Gateway is a much more scalable approach and is frequently pointed to in our reference architecture guides for AWS. It does take more work to set up but can be a phenomenal tool for linking many VPCs and is also a recommended tool for enabling E-W traffic monitoring and segmentation using the Gateway Load Balancer VM-Series Integration


This is much more recommended, does not have the routing limitation I referenced for the VGW above, and can help you insert other use cases moving forward. For organizations that can do so, we recommend going with a TGW based architecture for multiple use cases.




The last option is to directly insert VM-Series firewalls into your VPC and terminate the IPSec tunnel to that/those EC2 instances. This gives you the security benefits and removes the routing / dropping traffic to other VPCs issues of the VGW architecture, but is a bit less effort to set up than the TGW architecture. This is often a good starting point for organizations that will look to deploy the TGW architecture, but are not there yet and want to get the ball rolling on their Prisma Access deployment.



  • 0 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!