deploying-palo-alto-prisma-access-zero-trust

部署 Palo Alto Prisma Access 零信任

适用场景

• 在实施集成 ZTNA、SWG、CASB 和 FWaaS 的企业级 SASE 时
• 在用云交付安全替代 VPN 和分支机构防火墙时
• 在需要针对远程访问流量提供高级威胁防护（WildFire、DNS Security）时
• 在为移动用户和远程网络（分支机构）连接部署零信任时
• 在通过 Strata Cloud Manager 将 ZTNA 与现有 Palo Alto NGFW 基础设施集成时

不要使用 于小型组织（< 200 名用户）——更简单的 ZTNA 解决方案即可满足需求；仅需访问 Web 应用而无需完整网络安全的场景；或预算限制无法承担企业级 SASE 许可的情况。

前置条件

• Prisma Access 许可证（Business Premium 或同等版本）
• 已配置 Strata Cloud Manager (SCM) 租户
• 用于终端部署的 GlobalProtect agent
• ZTNA Connector VM：4 vCPU、8GB RAM、128GB 磁盘（VMware、AWS、Azure 或 GCP）
• 身份提供方：Okta、Entra ID、Ping Identity（SAML 2.0）
• 用于日志存储的 Palo Alto Cortex Data Lake

工作流

第 1 步：在 Strata Cloud Manager 中配置 Prisma Access 基础设施

为移动用户和远程网络连接设置云基础设施。

Strata Cloud Manager > Prisma Access > Infrastructure Settings:

Mobile Users Configuration:
  - Service Connection: Auto-selected based on user location
  - DNS Servers: 10.1.1.10, 10.1.1.11 (corporate DNS)
  - IP Pool for Mobile Users: 10.100.0.0/16
  - Authentication: SAML with Okta (Primary), Entra ID (Secondary)
  - GlobalProtect Portal: portal.company.com
  - GlobalProtect Gateway: Auto (nearest Prisma Access location)

Infrastructure Subnet:
  - Range: 172.16.0.0/16
  - Allocation: /24 per Prisma Access location

第 2 步：部署 ZTNA Connectors 以访问私有应用

安装 ZTNA Connectors 以提供对内部应用的安全访问。

# Deploy ZTNA Connector on VMware (OVA)
# Download OVA from Strata Cloud Manager > Prisma Access > ZTNA Connectors

# AWS deployment via CloudFormation
aws cloudformation create-stack \
  --stack-name prisma-ztna-connector \
  --template-url https://prisma-access-connector-templates.s3.amazonaws.com/ztna-connector-aws.yaml \
  --parameters \
    ParameterKey=VpcId,ParameterValue=vpc-PROD \
    ParameterKey=SubnetId,ParameterValue=subnet-PRIVATE \
    ParameterKey=InstanceType,ParameterValue=m5.xlarge \
    ParameterKey=TenantServiceGroup,ParameterValue=TSG_ID \
    ParameterKey=ConnectorName,ParameterValue=dc-east-connector-01

# Verify connector registration
# Strata Cloud Manager > Prisma Access > ZTNA Connectors
# Status should show "Connected" with nearest Prisma Access location

# Deploy second connector for HA
# ZTNA Connector auto-discovers nearest Prisma Access location
# IPSec tunnel uses: ecp384/aes256/sha512 for IKE and ESP
# Bandwidth: up to 2 Gbps per connector

第 3 步：定义应用定义和访问策略

创建通过 ZTNA Connectors 指向内部应用的应用定义。

Strata Cloud Manager > Prisma Access > Applications:

Application 1: Internal Wiki
  - FQDN: wiki.internal.corp
  - Port: TCP 443
  - ZTNA Connector: dc-east-connector-01
  - Protocol: HTTPS
  - Health Check: Enabled (HTTP GET /health)

Application 2: Source Code Repository
  - FQDN: git.internal.corp
  - Ports: TCP 22, 443
  - ZTNA Connector: dc-east-connector-01, dc-east-connector-02
  - Protocol: HTTPS, SSH

Application 3: Finance ERP
  - FQDN: erp.internal.corp
  - Port: TCP 443
  - ZTNA Connector: dc-east-connector-01
  - Protocol: HTTPS
  - User Authentication: Required (re-auth every 2h)

Strata Cloud Manager > Policies > Security Policy:

Rule 1: Engineering Access to Dev Tools
  Source: User Group "Engineering" (from Okta SAML)
  Destination: Application "Source Code Repository", "Internal Wiki"
  HIP Profile: "Managed Device with CrowdStrike"
  Action: Allow
  Logging: Enabled
  Threat Prevention: Best Practice profile

Rule 2: Finance Access to ERP
  Source: User Group "Finance"
  Destination: Application "Finance ERP"
  HIP Profile: "Compliant Device - High Security"
  Action: Allow
  SSL Decryption: Forward Proxy
  DLP Profile: "Financial Data Protection"

Rule 3: Default Deny Private Apps
  Source: Any
  Destination: Any Private App
  Action: Deny
  Logging: Enabled

第 4 步：配置主机信息配置文件 (HIP) 以进行设备状态检查

使用 HIP 检查定义设备状态要求。

Strata Cloud Manager > Objects > GlobalProtect > HIP Objects:

HIP Object: "CrowdStrike Running"
  - Vendor: CrowdStrike
  - Product: Falcon Sensor
  - Is Running: Yes
  - Minimum Version: 7.10

HIP Object: "Disk Encryption Enabled"
  - Windows: BitLocker = Encrypted
  - macOS: FileVault = Encrypted

HIP Object: "OS Patch Level"
  - Windows: >= 10.0.22631
  - macOS: >= 14.0

HIP Profile: "Managed Device with CrowdStrike"
  - Match: "CrowdStrike Running" AND "Disk Encryption Enabled"

HIP Profile: "Compliant Device - High Security"
  - Match: "CrowdStrike Running" AND "Disk Encryption Enabled" AND "OS Patch Level"

第 5 步：将 GlobalProtect Agent 部署到终端

推出 GlobalProtect agent 以实现安全连接。

# Deploy GlobalProtect via Intune (Windows)
# MSI download from Strata Cloud Manager > GlobalProtect > Agent Downloads

# GlobalProtect pre-deployment configuration
# pre-deploy.xml for automated portal connection:
cat > pre-deploy.xml << 'EOF'
<GlobalProtect>
  <Settings>
    <portal>portal.company.com</portal>
    <connect-method>pre-logon</connect-method>
    <authentication-override>
      <generate-cookie>yes</generate-cookie>
      <cookie-lifetime>24</cookie-lifetime>
    </authentication-override>
  </Settings>
</GlobalProtect>
EOF

# Verify GlobalProtect connection status
# GlobalProtect system tray > Settings > Connection Details
# Should show: Connected to nearest Prisma Access gateway
# IPSec tunnel established with full threat prevention

第 6 步：配置日志记录和监控

设置 Cortex Data Lake 集成和监控仪表板。

Strata Cloud Manager > Prisma Access > Monitoring:

Log Forwarding:
  - Cortex Data Lake: Enabled (all log types)
  - SIEM Forwarding: Splunk HEC (https://splunk-hec.company.com:8088)
  - Log Types: Traffic, Threat, URL, WildFire, GlobalProtect, HIP Match

Dashboard Monitoring:
  - Mobile Users: Active connections, locations, bandwidth
  - ZTNA Connectors: Health, latency, tunnel status
  - Security Events: Threats blocked, DLP violations, HIP failures
  - Application Usage: Top apps, top users, denied access attempts

Alerting:
  - ZTNA Connector down: Email + PagerDuty
  - HIP failure rate > 10%: Email to IT
  - Threat detected on mobile user: SOC alert

关键概念

术语	定义
Prisma Access	Palo Alto 的云交付 SASE 平台，通过单一架构提供 FWaaS、SWG、CASB、DLP 和 ZTNA
ZTNA Connector	基于 VM 的连接器，从内部网络建立到 Prisma Access 的 IPSec 隧道，以访问私有应用
GlobalProtect	终端 agent，通过 HIP 检查和始终开启的 VPN 提供到 Prisma Access 的安全连接
主机信息配置文件 (HIP)	设备状态检查，在授予访问权限前评估终端安全状态（EDR、加密、补丁）
Strata Cloud Manager	用于 Prisma Access、NGFW 和 Prisma Cloud 安全策略的统一管理控制台
Cortex Data Lake	用于 Palo Alto 安全遥测的基于云的日志存储和分析平台

工具与系统

• Prisma Access：云交付 SASE，集成 ZTNA、SWG、CASB、DLP、FWaaS
• Strata Cloud Manager (SCM)：跨 Palo Alto 安全产品的统一策略管理
• GlobalProtect Agent：具有 HIP 数据收集功能的终端连接 agent
• ZTNA Connector：用于内部应用访问的仅出站隧道连接器
• Cortex Data Lake：具有分析和威胁检测功能的集中式日志存储
• WildFire：与 Prisma Access 集成的基于云的恶意软件分析和防护

常见场景

场景：面向 5,000 用户组织的企业 SASE 迁移

背景：一家拥有 5,000 名用户、分布在 15 个办公地点的制造公司，正在将 VPN、SWG 和分支防火墙整合为 Prisma Access SASE。用户需要访问 50 多个内部应用，并且无论身处何地都需要一致的安全性。

方案：

1. 在 3 个数据中心部署 ZTNA Connector（每个 DC 2 个以实现 HA），用于内部应用访问
2. 配置 GlobalProtect 并启用登录前连接，以实现始终在线的安全性
3. 在 SCM 中定义 50 多个应用定义，并配置 FQDN 和端口映射
4. 创建 HIP 配置文件：Standard（加密 + AV）、Enhanced（+ CrowdStrike + 补丁）
5. 构建安全策略，将用户组映射到应用，并设置 HIP 要求
6. 启用威胁防护配置文件（Anti-Spyware、Anti-Virus、WildFire、URL Filtering）
7. 通过 SCCM 分阶段向全部 5,000 个端点部署 GlobalProtect agent
8. 配置 Cortex Data Lake 转发到 Splunk，用于 SOC 监控
9. 停用 VPN 集中器和分支防火墙设备

注意事项：ZTNA Connector 至少需要 4 vCPU 和 8GB RAM；配置不足会导致延迟。GlobalProtect 登录前连接需要机器证书，以便在用户登录前进行身份验证。HIP 检查间隔应至少为 60 秒，以避免影响性能。在全面部署前，应规划 4-6 周的试点。

输出格式

Prisma Access ZTNA Deployment Report
==================================================
Organization: ManufactureCorp
Deployment Date: 2026-02-23

INFRASTRUCTURE:
  ZTNA Connectors: 6 (2x DC-East, 2x DC-West, 2x DC-EU)
  Prisma Access Locations: 8 (auto-selected)
  GlobalProtect Portal: portal.manufacturecorp.com

APPLICATION ACCESS:
  Defined Applications: 52
  Active ZTNA Connections: 3,247
  Average Latency: 12ms

ENDPOINT DEPLOYMENT:
  GlobalProtect Deployed: 4,812 / 5,000 (96.2%)
  HIP Compliant: 4,567 / 4,812 (94.9%)
  HIP Failures: 245 (top: missing patches 120, encryption 85)

SECURITY (last 30 days):
  Threats Blocked: 1,234
  DLP Violations: 89
  URL Blocked: 45,678
  WildFire Submissions: 2,345