FW at branch with SASE

[FWPalolearner]

Hello ,

We have a customer having branches all across the globe but very very less MPLS . 95 % they are con,nected via IPSEC VPN Tunnels

They have Fortinet Fortigate FWs at their Branches and DCs

Does Prisma Access need Palo Alto FW at each Branch ?  I believe only thing needed is to make an IPSEC Connection from Branch to the SASE cloud which even a Router at Branch can make . But just confirming ?

Also I know Prisma Access need Panorama but does it need any PAN GW also ? In my case , all the GW at branches and DC are Fortigate ( Non PAN ) .

[tabner]

The only requirement at the branch is that the CPE can build an IPSec tunnel to Prisma Access.  So it doesn't matter which vendor it is.

You don't need a PAN NGFW or any other FW at the branches unless you need local (east-West) segmentation/security or to inspect traffic that you aren't sending to Prisma Access(e.g. MPLS traffic that won't traverse Prisma Access).  You could use a router to forward all traffic via an IPSec tunnel to Prisma Access.

The only recommendation for on-prem FWs is for sites where you have service connections.  These are the connections to data centers for the branches and users to access internal shared resources (e.g. AD).   The service connections are not subjected to policy so its recommended that you have a FW terminating the Service Connections

[FWPalolearner]

Ok thanks a lot,

So the fw where service.connection has to be terminated has to be a PANFw or any FW Like fortigate etc ?

Also , this means that only Palo Alto component needed other than primsa access cloud is panorama ?

[tabner · Accepted solution]

Yup, any FW.  You must have Panorama and you also must have Cortex Data Lake for logging.  When you purchase Prisma Access, it always comes with data lake for logging.  You don't do hardly anything with the data lake after initial setup and that is pretty simple.

[FWPalolearner]

Thanks @tabner  that's pretty quick.

Really appreciate your feedback