What is your primary use case for Prisma SD-WAN?

Prisma SD-WAN offers the same functionalities as Palo Alto CloudGenix, but my company uses it for different clients who operate retail chains. All the places where I have seen a big business setup, consisting of the head office, warehouse, sales office, and different kinds of offices for a particular area of business, require everything to be connected with their data centers, which is one of the main requirements of a business for which Prisma SD-WAN is required. Depending on the needs of my company's customers, we suggest Meraki, CloudGenix, or Juniper since the basic nature of all the aforementioned products is the same for a multi-point business setup.

We are doing a proof of concept for Prisma SD-WAN and considering whether to migrate from our existing solution. We are attempting to replicate our existing technology and duplicate that traffic.

Prisma SD-WAN is cost-effective and easy to manage. We have replaced all our MPLS connections with dial-up internet links. This will reduce our costs in place of ISP and is easy to manage. We can route the traffic based on the application. Sometimes, we used to route the package based on the user because some users want to use the internet. We are effectively using the solution for path manipulation for the users. We also have multiple tunnels whenever there is an issue or drop with one of the ISP tunnels.

We have introduced many applications for our clients and they need to launch with very minimal latency. Running them through traditional processes is not sufficient for our network or for our customers' or clients' satisfaction. We have moved to the SD-WAN approach.

I deal with various attack support use cases for multiple organizations. The most common use case is when enterprises are looking for easy failover of their links and better visibility into their network environments and traffic. It also supports integration with other vendors' products, like Slack or Teams, and integration with Prisma Access, a cloud-based firewall. We also have a cloud presence, but we need the licenses for firewalls or routers in the cloud. We have more than 700 tenants or users. I can't disclose customer names, but we have clients in retail, auto manufacturing, banks, and manufacturers of consumer products like toothpaste. I have clients ranging from the Australian time zone to the European time zones. There are some working in the United States, as well.

We use Prisma SD-WAN for nearly everything. It is deployed at all our remote locations across nine states, and we have cores in our data center. Each branch is connected to the cores. A high-availability pair we use for our primary banking software is stood up at one of our vendors. All these devices have direct VPN tunnels to a pair strip in their data center. We stood up the HA pair with VM infrastructure and AWS, and all branches have direct VPN connections to those devices. This passes all the traffic for the branches and networks. We have these devices deployed on AWS, but we're not using the AWS aspect to send policy or control the branch management. We do it from the local device or the hardware cores in our data center. As far as WAN, you can build direct tunnels. If we did management from the cloud, we would have direct VPN tunnels to that cloud service.

We can integrate Prisma SD-WAN with Zscaler, a third-party application, as well as with Prisma Access from Palo Alto. These are the endpoints. That means we are controlling the internet traffic. These days, with so many people working from home due to Corona, we have to control the internet traffic. That is one of the main use cases for Prisma SD-WAN. Another use case is because in Europe there are multiple languages. Some of our customers complain that when they are browsing the internet, they are not getting their local language, or they're not getting English. The reason is that we have established Zscaler connectivity. The low latency endpoint, because Zscaler is in the cloud, is communicating to the branch and, as a result, they're getting a different language. In such a case, we build a static tunnel to the static Zscaler and a static tunnel to the node. We can establish that connectivity in Prisma SD-WAN and it will connect smoothly, without any issues.

We use this solution to enable better connectivity for utilizing the more available Internet broadband lines instead of the expensive MPLS lines. The solution is deployed on the cloud. I'm using version 5.4. There are 15 people using this solution in my organization, including network and security engineers. We currently don't have any plans to increase usage.

The solution is used for multi-cloud and remote access for workers. On top of that is the CASB use case. We are going for zero-trust. If you want to implement zero-trust, this approach is very successful.

Initially, we deployed it in a hybrid fashion and were utilizing the Internet, but we had MPLS being defined on our WAN routers as well. While the MPLS link wasn't terminated on Prisma SD-WAN, it was helping us route traffic through it. This made the WAN routers kind of redundant since the solution creates its VPN tunnels from Internet links and we have data center devices where it establishes its tunnels. Therefore, if any MPLS goes down in any of our branch offices, it helps us route the traffic through them. We have a site where we deployed its VPN tunnels through MPLS, not just the Internet. However, we still have some BFD issues there. Right now, we are transitioning our sites to all Internet circuit sites. We are deploying our Prisma SD-WANs there. So, it is just doing VPN tunnels through the Internet with no MPLS on all new upcoming sites. We are transitioning into AWS.