About smarcyes

Im still trying to get a grasp of the concept of SDWAN - DIA anypath.  The components and configuration are pretty straight forward but the "why/when" is not making sense.  The main scenario that's proposed is "when you want to fail over to using the internet at another site (over the vpn) when local DIA is not available."  Again, I must be missing something obvious here but when your local internet is down, the vpn is most likely down as well. You cant fail over to the vpn.  I can understand some of the other scenarios mentioned such as having some bandwidth heavy applications go out local internet while having some applications go out the hub internet for extra inspection/visibility. ... View more

Im really new to Prisma Access as I am still learning. From what I gathered so far though, the use cases seem to be very niche if Im understanding correctly.  Much of Prisma Access advantages seems to be in gaining standard PA features/security while maintaining minimal Internet latency based on the users location.  Please help me if my assumptions/understanding below are incorrect and/or if there are some instances where I may not be considering.   Cases where Prisma Access doesnt seem to be a fit   Scenario1 A customer with a single main site/DC and any number of remote users that all typically reside in close proximity (500 miles) of the main site/DC.  Remote users can vpn back into the main DC and maintain the same features provided by the main PAs at the main site.  I wouldnt think it would make sense to deploy Prisma Access in this situation because all users in this instance would have the standard features provided by the main site PAs and with most remote users being relatively close, there arent any latency gains.   Scearnio2 A customer with several main sites/DCs and several branch sites spread throughout a single country.  All sites are running PA firewalls for their WAN/Internet connectivity.  Again, with running PA products at all sites, PA standards should be able to be met.  Panorama should be able to maintain a standard for all configurations.  Assuming DCs arent extremely large distances between each other witinh the country, again, the latency you might gain by a local Prisma Access instance doesnt seem to really warrant its need.   Possible Cases for Prisma Access Scenario1 A multinational customer with offices spread throughout the world with DCs in only specific strategic locations.  Remote users and/or branches may be spread in far distances from the DCs.  In this case, I can see the value in Prisma Access as you dont want remote users in Japan for instance VPNing all the way back to the UK.  This Prisma Access could provide the same standard PA features/security whole not causing excessive delay from remote users say in Japan from having to remote all the way back to the UK. Scenario2 A customer operating within a single country with main sites, branches and remote users spread throughout the country.  However, in this instance, they dont have PA firewalls at all these locations.  Thus without PA firewalls at all locations, PA standards/security cant be maintained.  Prisma Access would provide this set of standard access/policy.  My main possible objection here is that that the branches are still going to need some form of router/firewall at these branch locations.  So, yes theoretically, a company could go with a super low cost option for the local branches' router/firewall for internet and ipsec connectivity to Prisma, but would the cost of Prisma access for that branch basically be the cost to eventually to upgrade that branch with a small PA?    Also, overall in regards to the "services" vpn from prisma access to your main site for remote and branch access to resources at your main site, the concern there is the latency with essentially the "double vpn".  There is the vpn from the remote user/branch to Prisma Access and then the vpn from Prisma to your main site over the services connection.  To me this would add considerable delay as with any other double vpn solution?  ... View more