deploying-palo-alto-prisma-access-zero-trust

mukul975/Anthropic-Cybersecurity-Skills · updated May 25, 2026

MDX-style export adds YAML metadata + attribution linking explainx.ai and this canonical listing URL.

$npx skills install mukul975/Anthropic-Cybersecurity-Skills/deploying-palo-alto-prisma-access-zero-trust
0 commentsdiscussion
summary

Deploying Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager for unified security management.

skill.md
name
deploying-palo-alto-prisma-access-zero-trust
description
'Deploying Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager for unified security management. '
domain
cybersecurity
subdomain
zero-trust-architecture
tags
- prisma-access - palo-alto - ztna - sase - globalprotect - strata-cloud-manager - zero-trust
version
'1.0'
author
mahipal
license
Apache-2.0
nist_ai_rmf
- GOVERN-1.1 - MEASURE-2.7 - MANAGE-3.1
nist_csf
- PR.AA-01 - PR.AA-05 - PR.IR-01 - GV.PO-01

Deploying Palo Alto Prisma Access Zero Trust

When to Use

  • When implementing enterprise-grade SASE with integrated ZTNA, SWG, CASB, and FWaaS
  • When replacing both VPN and branch office firewalls with cloud-delivered security
  • When needing advanced threat prevention (WildFire, DNS Security) for remote access traffic
  • When deploying zero trust for both mobile users and remote network (branch) connections
  • When integrating ZTNA with existing Palo Alto NGFW infrastructure via Strata Cloud Manager

Do not use for small organizations (< 200 users) where simpler ZTNA solutions suffice, for environments requiring only web application access without full network security, or when budget constraints preclude enterprise SASE licensing.

Prerequisites

  • Prisma Access license (Business Premium or equivalent)
  • Strata Cloud Manager (SCM) tenant configured
  • GlobalProtect agent for endpoint deployment
  • ZTNA Connector VM: 4 vCPU, 8GB RAM, 128GB disk (VMware, AWS, Azure, or GCP)
  • Identity provider: Okta, Entra ID, Ping Identity (SAML 2.0)
  • Palo Alto Cortex Data Lake for log storage

Workflow

Step 1: Configure Prisma Access Infrastructure in Strata Cloud Manager

Set up the cloud infrastructure for mobile user and remote network connections.

Strata Cloud Manager > Prisma Access > Infrastructure Settings:

Mobile Users Configuration:
  - Service Connection: Auto-selected based on user location
  - DNS Servers: 10.1.1.10, 10.1.1.11 (corporate DNS)
  - IP Pool for Mobile Users: 10.100.0.0/16
  - Authentication: SAML with Okta (Primary), Entra ID (Secondary)
  - GlobalProtect Portal: portal.company.com
  - GlobalProtect Gateway: Auto (nearest Prisma Access location)

Infrastructure Subnet:
  - Range: 172.16.0.0/16
  - Allocation: /24 per Prisma Access location

Step 2: Deploy ZTNA Connectors for Private Application Access

Install ZTNA Connectors to provide secure access to internal applications.

# Deploy ZTNA Connector on VMware (OVA)
# Download OVA from Strata Cloud Manager > Prisma Access > ZTNA Connectors

# AWS deployment via CloudFormation
aws cloudformation create-stack \
  --stack-name prisma-ztna-connector \
  --template-url https://prisma-access-connector-templates.s3.amazonaws.com/ztna-connector-aws.yaml \
  --parameters \
    ParameterKey=VpcId,ParameterValue=vpc-PROD \
    ParameterKey=SubnetId,ParameterValue=subnet-PRIVATE \
    ParameterKey=InstanceType,ParameterValue=m5.xlarge \
    ParameterKey=TenantServiceGroup,ParameterValue=TSG_ID \
    ParameterKey=ConnectorName,ParameterValue=dc-east-connector-01

# Verify connector registration
# Strata Cloud Manager > Prisma Access > ZTNA Connectors
# Status should show "Connected" with nearest Prisma Access location

# Deploy second connector for HA
# ZTNA Connector auto-discovers nearest Prisma Access location
# IPSec tunnel uses: ecp384/aes256/sha512 for IKE and ESP
# Bandwidth: up to 2 Gbps per connector

Step 3: Define Application Definitions and Access Policies

Create application definitions pointing to internal applications via ZTNA Connectors.

Strata Cloud Manager > Prisma Access > Applications:

Application 1: Internal Wiki
  - FQDN: wiki.internal.corp
  - Port: TCP 443
  - ZTNA Connector: dc-east-connector-01
  - Protocol: HTTPS
  - Health Check: Enabled (HTTP GET /health)

Application 2: Source Code Repository
  - FQDN: git.internal.corp
  - Ports: TCP 22, 443
  - ZTNA Connector: dc-east-connector-01, dc-east-connector-02
  - Protocol: HTTPS, SSH

Application 3: Finance ERP
  - FQDN: erp.internal.corp
  - Port: TCP 443
  - ZTNA Connector: dc-east-connector-01
  - Protocol: HTTPS
  - User Authentication: Required (re-auth every 2h)

Strata Cloud Manager > Policies > Security Policy:

Rule 1: Engineering Access to Dev Tools
  Source: User Group "Engineering" (from Okta SAML)
  Destination: Application "Source Code Repository", "Internal Wiki"
  HIP Profile: "Managed Device with CrowdStrike"
  Action: Allow
  Logging: Enabled
  Threat Prevention: Best Practice profile

Rule 2: Finance Access to ERP
  Source: User Group "Finance"
  Destination: Application "Finance ERP"
  HIP Profile: "Compliant Device - High Security"
  Action: Allow
  SSL Decryption: Forward Proxy
  DLP Profile: "Financial Data Protection"

Rule 3: Default Deny Private Apps
  Source: Any
  Destination: Any Private App
  Action: Deny
  Logging: Enabled

Step 4: Configure Host Information Profile (HIP) for Device Posture

Define device posture requirements using HIP checks.

Strata Cloud Manager > Objects > GlobalProtect > HIP Objects:

HIP Object: "CrowdStrike Running"
  - Vendor: CrowdStrike
  - Product: Falcon Sensor
  - Is Running: Yes
  - Minimum Version: 7.10

HIP Object: "Disk Encryption Enabled"
  - Windows: BitLocker = Encrypted
  - macOS: FileVault = Encrypted

HIP Object: "OS Patch Level"
  - Windows: >= 10.0.22631
  - macOS: >= 14.0

HIP Profile: "Managed Device with CrowdStrike"
  - Match: "CrowdStrike Running" AND "Disk Encryption Enabled"

HIP Profile: "Compliant Device - High Security"
  - Match: "CrowdStrike Running" AND "Disk Encryption Enabled" AND "OS Patch Level"

Step 5: Deploy GlobalProtect Agent to Endpoints

Roll out the GlobalProtect agent for secure connectivity.

# Deploy GlobalProtect via Intune (Windows)
# MSI download from Strata Cloud Manager > GlobalProtect > Agent Downloads

# GlobalProtect pre-deployment configuration
# pre-deploy.xml for automated portal connection:
cat > pre-deploy.xml << 'EOF'
<GlobalProtect>
  <Settings>
    <portal>portal.company.com</portal>
    <connect-method>pre-logon</connect-method>
    <authentication-override>
      <generate-cookie>yes</generate-cookie>
      <cookie-lifetime>24</cookie-lifetime>
    </authentication-override>
  </Settings>
</GlobalProtect>
EOF

# Verify GlobalProtect connection status
# GlobalProtect system tray > Settings > Connection Details
# Should show: Connected to nearest Prisma Access gateway
# IPSec tunnel established with full threat prevention

Step 6: Configure Logging and Monitoring

Set up Cortex Data Lake integration and monitoring dashboards.

Strata Cloud Manager > Prisma Access > Monitoring:

Log Forwarding:
  - Cortex Data Lake: Enabled (all log types)
  - SIEM Forwarding: Splunk HEC (https://splunk-hec.company.com:8088)
  - Log Types: Traffic, Threat, URL, WildFire, GlobalProtect, HIP Match

Dashboard Monitoring:
  - Mobile Users: Active connections, locations, bandwidth
  - ZTNA Connectors: Health, latency, tunnel status
  - Security Events: Threats blocked, DLP violations, HIP failures
  - Application Usage: Top apps, top users, denied access attempts

Alerting:
  - ZTNA Connector down: Email + PagerDuty
  - HIP failure rate > 10%: Email to IT
  - Threat detected on mobile user: SOC alert

Key Concepts

TermDefinition
Prisma AccessPalo Alto's cloud-delivered SASE platform providing FWaaS, SWG, CASB, DLP, and ZTNA from a single architecture
ZTNA ConnectorVM-based connector establishing IPSec tunnels from internal networks to Prisma Access for private application access
GlobalProtectEndpoint agent providing secure connectivity to Prisma Access with HIP checks and always-on VPN
Host Information Profile (HIP)Device posture checks evaluating endpoint security state (EDR, encryption, patches) before granting access
Strata Cloud ManagerUnified management console for Prisma Access, NGFW, and Prisma Cloud security policy
Cortex Data LakeCloud-based log storage and analytics platform for Palo Alto security telemetry

Tools & Systems

  • Prisma Access: Cloud-delivered SASE with integrated ZTNA, SWG, CASB, DLP, FWaaS
  • Strata Cloud Manager (SCM): Unified policy management across Palo Alto security products
  • GlobalProtect Agent: Endpoint connectivity agent with HIP data collection
  • ZTNA Connector: Outbound-only tunnel connector for internal application access
  • Cortex Data Lake: Centralized log storage with analytics and threat detection
  • WildFire: Cloud-based malware analysis and prevention integrated with Prisma Access

Common Scenarios

Scenario: Enterprise SASE Migration for 5,000-User Organization

Context: A manufacturing company with 5,000 users across 15 offices is consolidating VPN, SWG, and branch firewalls into Prisma Access SASE. Users access 50+ internal applications and need consistent security regardless of location.

Approach:

  1. Deploy ZTNA Connectors at 3 data centers (2 per DC for HA) for internal application access
  2. Configure GlobalProtect with pre-logon connection for always-on security
  3. Define 50+ application definitions in SCM with FQDN and port mappings
  4. Create HIP profiles: Standard (encryption + AV), Enhanced (+ CrowdStrike + patches)
  5. Build security policies mapping user groups to applications with HIP requirements
  6. Enable threat prevention profiles (Anti-Spyware, Anti-Virus, WildFire, URL Filtering)
  7. Deploy GlobalProtect agent via SCCM to all 5,000 endpoints in phases
  8. Configure Cortex Data Lake forwarding to Splunk for SOC monitoring
  9. Decommission VPN concentrators and branch firewall appliances

Pitfalls: ZTNA Connector requires minimum 4 vCPU and 8GB RAM; under-provisioning causes latency. GlobalProtect pre-logon requires machine certificates for authentication before user login. HIP check intervals should be 60 seconds minimum to avoid performance impact. Plan for a 4-6 week pilot before full deployment.

Output Format

Prisma Access ZTNA Deployment Report
==================================================
Organization: ManufactureCorp
Deployment Date: 2026-02-23

INFRASTRUCTURE:
  ZTNA Connectors: 6 (2x DC-East, 2x DC-West, 2x DC-EU)
  Prisma Access Locations: 8 (auto-selected)
  GlobalProtect Portal: portal.manufacturecorp.com

APPLICATION ACCESS:
  Defined Applications: 52
  Active ZTNA Connections: 3,247
  Average Latency: 12ms

ENDPOINT DEPLOYMENT:
  GlobalProtect Deployed: 4,812 / 5,000 (96.2%)
  HIP Compliant: 4,567 / 4,812 (94.9%)
  HIP Failures: 245 (top: missing patches 120, encryption 85)

SECURITY (last 30 days):
  Threats Blocked: 1,234
  DLP Violations: 89
  URL Blocked: 45,678
  WildFire Submissions: 2,345
how to use deploying-palo-alto-prisma-access-zero-trust

How to use deploying-palo-alto-prisma-access-zero-trust on Cursor

AI-first code editor with Composer

1

Prerequisites

Before installing skills in Cursor, ensure your development environment meets these requirements:

  • Cursor installed and configured on your development machine
  • Node.js version 16.0+ with npm package manager (verify with node --version)
  • Active project directory or workspace where you want to add deploying-palo-alto-prisma-access-zero-trust
2

Execute installation command

Execute the skills CLI command in your project's root directory to begin installation:

$npx skills install mukul975/Anthropic-Cybersecurity-Skills/deploying-palo-alto-prisma-access-zero-trust

The skills CLI fetches deploying-palo-alto-prisma-access-zero-trust from GitHub repository mukul975/Anthropic-Cybersecurity-Skills and configures it for Cursor.

3

Select Cursor when prompted

The CLI will show a list of available agents. Use arrow keys to navigate and space to select Cursor:

◆ Which agents do you want to install to?
│ ── Universal (.agents/skills) ── always included ────
│ • Amp
│ • Antigravity
│ • Cline
│ • Codex
│ ●Cursor(selected)
│ • Cursor
│ • Windsurf
4

Verify installation

Confirm successful installation by checking the skill directory location:

.cursor/skills/deploying-palo-alto-prisma-access-zero-trust

Reload or restart Cursor to activate deploying-palo-alto-prisma-access-zero-trust. Access the skill through slash commands (e.g., /deploying-palo-alto-prisma-access-zero-trust) or your agent's skill management interface.

Security & Verification Notice

We perform automated surface-level scans (Gen AI Scanner, Socket, Snyk) during installation. These checks detect common vulnerabilities but do not guarantee complete security. Always review skill source code and verify the publisher's reputation before production use.

Skills execute code in your development environment. Always verify the publisher's identity, review recent commits, and test in isolated environments before production deployment.

List & Monetize Your Skill

Submit your Claude Code skill and start earning

GET_STARTED →

Use Cases

Task Automation & Efficiency

Automate repetitive workflows and reduce manual effort

Example

Generate reports, summarize documents, draft communications

Save 3-5 hours per week on routine tasks

Knowledge Enhancement

Learn new skills, understand complex topics, get expert guidance

Example

Explain concepts, provide examples, suggest learning resources

Accelerate learning and skill development by 2x

Quality Improvement

Enhance output quality through reviews, suggestions, and refinements

Example

Review drafts, suggest improvements, catch errors

Improve work quality by 30-40% with less effort

Implementation Guide

Prerequisites

  • Claude Desktop or compatible AI client with skill support
  • Clear understanding of task or problem to solve
  • Willingness to iterate and refine outputs

Time Estimate

15-45 minutes depending on use case complexity

Installation Steps

  1. 1.Install skill using provided installation command
  2. 2.Test with simple use case relevant to your work
  3. 3.Evaluate output quality and relevance
  4. 4.Iterate on prompts to improve results
  5. 5.Integrate into regular workflow if valuable

Common Pitfalls

  • Expecting perfect results without iteration
  • Not providing enough context in prompts
  • Using skill for tasks outside its intended scope
  • Accepting outputs without review and validation

Best Practices

✓ Do

  • +Start with clear, specific prompts
  • +Provide relevant context and constraints
  • +Review and refine all outputs before using
  • +Iterate to improve output quality
  • +Document successful prompt patterns

✗ Don't

  • Don't use without understanding skill limitations
  • Don't skip validation of outputs
  • Don't share sensitive information in prompts
  • Don't expect skill to replace human judgment

💡 Pro Tips

  • Be specific about desired format and style
  • Ask for multiple options to choose from
  • Request explanations to understand reasoning
  • Combine AI efficiency with human expertise

When to Use This

✓ Use When

Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.

✗ Avoid When

Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.

Learning Path

  1. 1Familiarize yourself with skill capabilities and limitations
  2. 2Start with low-risk, non-critical tasks
  3. 3Progress to more complex and valuable use cases
  4. 4Build expertise through regular use and experimentation

Discussion

Product Hunt–style comments (not star reviews)
  • No comments yet — start the thread.
general reviews

Ratings

4.752 reviews
  • Anika Iyer· Dec 24, 2024

    deploying-palo-alto-prisma-access-zero-trust reduced setup friction for our internal harness; good balance of opinion and flexibility.

  • Henry Martinez· Dec 20, 2024

    Keeps context tight: deploying-palo-alto-prisma-access-zero-trust is the kind of skill you can hand to a new teammate without a long onboarding doc.

  • Harper Ramirez· Dec 16, 2024

    deploying-palo-alto-prisma-access-zero-trust fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.

  • Henry Robinson· Dec 8, 2024

    Registry listing for deploying-palo-alto-prisma-access-zero-trust matched our evaluation — installs cleanly and behaves as described in the markdown.

  • Anika Jackson· Nov 27, 2024

    Keeps context tight: deploying-palo-alto-prisma-access-zero-trust is the kind of skill you can hand to a new teammate without a long onboarding doc.

  • Chen Lopez· Nov 23, 2024

    deploying-palo-alto-prisma-access-zero-trust fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.

  • Isabella Perez· Nov 15, 2024

    deploying-palo-alto-prisma-access-zero-trust is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.

  • Olivia Sanchez· Nov 11, 2024

    Registry listing for deploying-palo-alto-prisma-access-zero-trust matched our evaluation — installs cleanly and behaves as described in the markdown.

  • Henry Thomas· Nov 11, 2024

    Solid pick for teams standardizing on skills: deploying-palo-alto-prisma-access-zero-trust is focused, and the summary matches what you get after install.

  • Anika Gupta· Oct 18, 2024

    deploying-palo-alto-prisma-access-zero-trust is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.

showing 1-10 of 52

1 / 6