Configuring the remote firewalls

Once Prisma Access has been fully configured, the remote firewalls still need to be configured so that they can connect to Prisma to establish the virtual network.

In the Configuring the service connections section earlier in this chapter, I set the remote peer to dynamic and behind a NAT device. The corresponding configuration on the remote firewall should look similar to what's shown in the following screenshot. While setting up your environment, set the configuration so that it reflects the actual situation in your deployment (that is, it will be likely that an actual data centre or HQ location will have a static IP and will not be behind a NAT device; these settings were set purely for demonstration purposes):

Figure 4.34 – Configuring the HQ firewall IKE gateway

The next step is to create an IPSec tunnel so that the firewall can establish the service connection. Make sure that you add all the relevant...