deploying-palo-alto-prisma-access-zero-trust
Deploying Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager for unified security management.
Best use case
deploying-palo-alto-prisma-access-zero-trust is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Deploying Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager for unified security management.
Teams using deploying-palo-alto-prisma-access-zero-trust should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/deploying-palo-alto-prisma-access-zero-trust/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How deploying-palo-alto-prisma-access-zero-trust Compares
| Feature / Agent | deploying-palo-alto-prisma-access-zero-trust | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Deploying Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager for unified security management.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
Related Guides
Best AI Skills for Claude
Explore the best AI skills for Claude and Claude Code across coding, research, workflow automation, documentation, and agent operations.
AI Agents for Marketing
Discover AI agents for marketing workflows, from SEO and content production to campaign research, outreach, and analytics.
AI Agents for Startups
Explore AI agent skills for startup validation, product research, growth experiments, documentation, and fast execution with small teams.
SKILL.md Source
# Deploying Palo Alto Prisma Access Zero Trust
## When to Use
- When implementing enterprise-grade SASE with integrated ZTNA, SWG, CASB, and FWaaS
- When replacing both VPN and branch office firewalls with cloud-delivered security
- When needing advanced threat prevention (WildFire, DNS Security) for remote access traffic
- When deploying zero trust for both mobile users and remote network (branch) connections
- When integrating ZTNA with existing Palo Alto NGFW infrastructure via Strata Cloud Manager
**Do not use** for small organizations (< 200 users) where simpler ZTNA solutions suffice, for environments requiring only web application access without full network security, or when budget constraints preclude enterprise SASE licensing.
## Prerequisites
- Prisma Access license (Business Premium or equivalent)
- Strata Cloud Manager (SCM) tenant configured
- GlobalProtect agent for endpoint deployment
- ZTNA Connector VM: 4 vCPU, 8GB RAM, 128GB disk (VMware, AWS, Azure, or GCP)
- Identity provider: Okta, Entra ID, Ping Identity (SAML 2.0)
- Palo Alto Cortex Data Lake for log storage
## Workflow
### Step 1: Configure Prisma Access Infrastructure in Strata Cloud Manager
Set up the cloud infrastructure for mobile user and remote network connections.
```text
Strata Cloud Manager > Prisma Access > Infrastructure Settings:
Mobile Users Configuration:
- Service Connection: Auto-selected based on user location
- DNS Servers: 10.1.1.10, 10.1.1.11 (corporate DNS)
- IP Pool for Mobile Users: 10.100.0.0/16
- Authentication: SAML with Okta (Primary), Entra ID (Secondary)
- GlobalProtect Portal: portal.company.com
- GlobalProtect Gateway: Auto (nearest Prisma Access location)
Infrastructure Subnet:
- Range: 172.16.0.0/16
- Allocation: /24 per Prisma Access location
```
### Step 2: Deploy ZTNA Connectors for Private Application Access
Install ZTNA Connectors to provide secure access to internal applications.
```bash
# Deploy ZTNA Connector on VMware (OVA)
# Download OVA from Strata Cloud Manager > Prisma Access > ZTNA Connectors
# AWS deployment via CloudFormation
aws cloudformation create-stack \
--stack-name prisma-ztna-connector \
--template-url https://prisma-access-connector-templates.s3.amazonaws.com/ztna-connector-aws.yaml \
--parameters \
ParameterKey=VpcId,ParameterValue=vpc-PROD \
ParameterKey=SubnetId,ParameterValue=subnet-PRIVATE \
ParameterKey=InstanceType,ParameterValue=m5.xlarge \
ParameterKey=TenantServiceGroup,ParameterValue=TSG_ID \
ParameterKey=ConnectorName,ParameterValue=dc-east-connector-01
# Verify connector registration
# Strata Cloud Manager > Prisma Access > ZTNA Connectors
# Status should show "Connected" with nearest Prisma Access location
# Deploy second connector for HA
# ZTNA Connector auto-discovers nearest Prisma Access location
# IPSec tunnel uses: ecp384/aes256/sha512 for IKE and ESP
# Bandwidth: up to 2 Gbps per connector
```
### Step 3: Define Application Definitions and Access Policies
Create application definitions pointing to internal applications via ZTNA Connectors.
```text
Strata Cloud Manager > Prisma Access > Applications:
Application 1: Internal Wiki
- FQDN: wiki.internal.corp
- Port: TCP 443
- ZTNA Connector: dc-east-connector-01
- Protocol: HTTPS
- Health Check: Enabled (HTTP GET /health)
Application 2: Source Code Repository
- FQDN: git.internal.corp
- Ports: TCP 22, 443
- ZTNA Connector: dc-east-connector-01, dc-east-connector-02
- Protocol: HTTPS, SSH
Application 3: Finance ERP
- FQDN: erp.internal.corp
- Port: TCP 443
- ZTNA Connector: dc-east-connector-01
- Protocol: HTTPS
- User Authentication: Required (re-auth every 2h)
Strata Cloud Manager > Policies > Security Policy:
Rule 1: Engineering Access to Dev Tools
Source: User Group "Engineering" (from Okta SAML)
Destination: Application "Source Code Repository", "Internal Wiki"
HIP Profile: "Managed Device with CrowdStrike"
Action: Allow
Logging: Enabled
Threat Prevention: Best Practice profile
Rule 2: Finance Access to ERP
Source: User Group "Finance"
Destination: Application "Finance ERP"
HIP Profile: "Compliant Device - High Security"
Action: Allow
SSL Decryption: Forward Proxy
DLP Profile: "Financial Data Protection"
Rule 3: Default Deny Private Apps
Source: Any
Destination: Any Private App
Action: Deny
Logging: Enabled
```
### Step 4: Configure Host Information Profile (HIP) for Device Posture
Define device posture requirements using HIP checks.
```text
Strata Cloud Manager > Objects > GlobalProtect > HIP Objects:
HIP Object: "CrowdStrike Running"
- Vendor: CrowdStrike
- Product: Falcon Sensor
- Is Running: Yes
- Minimum Version: 7.10
HIP Object: "Disk Encryption Enabled"
- Windows: BitLocker = Encrypted
- macOS: FileVault = Encrypted
HIP Object: "OS Patch Level"
- Windows: >= 10.0.22631
- macOS: >= 14.0
HIP Profile: "Managed Device with CrowdStrike"
- Match: "CrowdStrike Running" AND "Disk Encryption Enabled"
HIP Profile: "Compliant Device - High Security"
- Match: "CrowdStrike Running" AND "Disk Encryption Enabled" AND "OS Patch Level"
```
### Step 5: Deploy GlobalProtect Agent to Endpoints
Roll out the GlobalProtect agent for secure connectivity.
```bash
# Deploy GlobalProtect via Intune (Windows)
# MSI download from Strata Cloud Manager > GlobalProtect > Agent Downloads
# GlobalProtect pre-deployment configuration
# pre-deploy.xml for automated portal connection:
cat > pre-deploy.xml << 'EOF'
<GlobalProtect>
<Settings>
<portal>portal.company.com</portal>
<connect-method>pre-logon</connect-method>
<authentication-override>
<generate-cookie>yes</generate-cookie>
<cookie-lifetime>24</cookie-lifetime>
</authentication-override>
</Settings>
</GlobalProtect>
EOF
# Verify GlobalProtect connection status
# GlobalProtect system tray > Settings > Connection Details
# Should show: Connected to nearest Prisma Access gateway
# IPSec tunnel established with full threat prevention
```
### Step 6: Configure Logging and Monitoring
Set up Cortex Data Lake integration and monitoring dashboards.
```text
Strata Cloud Manager > Prisma Access > Monitoring:
Log Forwarding:
- Cortex Data Lake: Enabled (all log types)
- SIEM Forwarding: Splunk HEC (https://splunk-hec.company.com:8088)
- Log Types: Traffic, Threat, URL, WildFire, GlobalProtect, HIP Match
Dashboard Monitoring:
- Mobile Users: Active connections, locations, bandwidth
- ZTNA Connectors: Health, latency, tunnel status
- Security Events: Threats blocked, DLP violations, HIP failures
- Application Usage: Top apps, top users, denied access attempts
Alerting:
- ZTNA Connector down: Email + PagerDuty
- HIP failure rate > 10%: Email to IT
- Threat detected on mobile user: SOC alert
```
## Key Concepts
| Term | Definition |
|------|------------|
| Prisma Access | Palo Alto's cloud-delivered SASE platform providing FWaaS, SWG, CASB, DLP, and ZTNA from a single architecture |
| ZTNA Connector | VM-based connector establishing IPSec tunnels from internal networks to Prisma Access for private application access |
| GlobalProtect | Endpoint agent providing secure connectivity to Prisma Access with HIP checks and always-on VPN |
| Host Information Profile (HIP) | Device posture checks evaluating endpoint security state (EDR, encryption, patches) before granting access |
| Strata Cloud Manager | Unified management console for Prisma Access, NGFW, and Prisma Cloud security policy |
| Cortex Data Lake | Cloud-based log storage and analytics platform for Palo Alto security telemetry |
## Tools & Systems
- **Prisma Access**: Cloud-delivered SASE with integrated ZTNA, SWG, CASB, DLP, FWaaS
- **Strata Cloud Manager (SCM)**: Unified policy management across Palo Alto security products
- **GlobalProtect Agent**: Endpoint connectivity agent with HIP data collection
- **ZTNA Connector**: Outbound-only tunnel connector for internal application access
- **Cortex Data Lake**: Centralized log storage with analytics and threat detection
- **WildFire**: Cloud-based malware analysis and prevention integrated with Prisma Access
## Common Scenarios
### Scenario: Enterprise SASE Migration for 5,000-User Organization
**Context**: A manufacturing company with 5,000 users across 15 offices is consolidating VPN, SWG, and branch firewalls into Prisma Access SASE. Users access 50+ internal applications and need consistent security regardless of location.
**Approach**:
1. Deploy ZTNA Connectors at 3 data centers (2 per DC for HA) for internal application access
2. Configure GlobalProtect with pre-logon connection for always-on security
3. Define 50+ application definitions in SCM with FQDN and port mappings
4. Create HIP profiles: Standard (encryption + AV), Enhanced (+ CrowdStrike + patches)
5. Build security policies mapping user groups to applications with HIP requirements
6. Enable threat prevention profiles (Anti-Spyware, Anti-Virus, WildFire, URL Filtering)
7. Deploy GlobalProtect agent via SCCM to all 5,000 endpoints in phases
8. Configure Cortex Data Lake forwarding to Splunk for SOC monitoring
9. Decommission VPN concentrators and branch firewall appliances
**Pitfalls**: ZTNA Connector requires minimum 4 vCPU and 8GB RAM; under-provisioning causes latency. GlobalProtect pre-logon requires machine certificates for authentication before user login. HIP check intervals should be 60 seconds minimum to avoid performance impact. Plan for a 4-6 week pilot before full deployment.
## Output Format
```
Prisma Access ZTNA Deployment Report
==================================================
Organization: ManufactureCorp
Deployment Date: 2026-02-23
INFRASTRUCTURE:
ZTNA Connectors: 6 (2x DC-East, 2x DC-West, 2x DC-EU)
Prisma Access Locations: 8 (auto-selected)
GlobalProtect Portal: portal.manufacturecorp.com
APPLICATION ACCESS:
Defined Applications: 52
Active ZTNA Connections: 3,247
Average Latency: 12ms
ENDPOINT DEPLOYMENT:
GlobalProtect Deployed: 4,812 / 5,000 (96.2%)
HIP Compliant: 4,567 / 4,812 (94.9%)
HIP Failures: 245 (top: missing patches 120, encryption 85)
SECURITY (last 30 days):
Threats Blocked: 1,234
DLP Violations: 89
URL Blocked: 45,678
WildFire Submissions: 2,345
```Related Skills
testing-for-broken-access-control
Systematically testing web applications for broken access control vulnerabilities including privilege escalation, missing function-level checks, and insecure direct object references.
securing-remote-access-to-ot-environment
This skill covers implementing secure remote access to OT/ICS environments for operators, engineers, and vendors while preventing unauthorized access that could compromise industrial operations. It addresses jump server architecture, multi-factor authentication, session recording, privileged access management, vendor remote access controls, and compliance with IEC 62443 and NERC CIP-005 remote access requirements.
performing-privileged-account-access-review
Conduct systematic reviews of privileged accounts to validate access rights, identify excessive permissions, and enforce least privilege across PAM infrastructure.
performing-initial-access-with-evilginx3
Perform authorized initial access using EvilGinx3 adversary-in-the-middle phishing framework to capture session tokens and bypass multi-factor authentication during red team engagements.
performing-credential-access-with-lazagne
Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red team operations.
performing-access-review-and-certification
Conduct systematic access reviews and certifications to ensure users have appropriate access rights aligned with their roles. This skill covers review campaign design, reviewer selection, risk-based p
performing-access-recertification-with-saviynt
Configure and execute access recertification campaigns in Saviynt Enterprise Identity Cloud to validate user entitlements, revoke excessive access, and maintain compliance with SOX, SOC2, and HIPAA.
implementing-zero-trust-with-hashicorp-boundary
Implement HashiCorp Boundary for identity-aware zero trust infrastructure access management with dynamic credential brokering, session recording, and Vault integration.
implementing-zero-trust-with-beyondcorp
Deploy Google BeyondCorp Enterprise zero trust access controls using Identity-Aware Proxy (IAP), context-aware access policies, device trust validation, and Access Context Manager to enforce identity and posture-based access to GCP resources and internal applications.
implementing-zero-trust-network-access
Implementing Zero Trust Network Access (ZTNA) in cloud environments by configuring identity-aware proxies, micro-segmentation, continuous verification with conditional access policies, and replacing traditional VPN-based access with BeyondCorp-style architectures across AWS, Azure, and GCP.
implementing-zero-trust-network-access-with-zscaler
Implement Zero Trust Network Access using Zscaler Private Access (ZPA) to replace traditional VPN with identity-based, context-aware access to private applications through the Zscaler Zero Trust Exchange.
implementing-zero-trust-in-cloud
This skill guides organizations through implementing zero trust architecture in cloud environments following NIST SP 800-207 and Google BeyondCorp principles. It covers identity-centric access controls, micro-segmentation, continuous verification, device trust assessment, and deploying Identity-Aware Proxy to eliminate implicit network trust in AWS, Azure, and GCP environments.