Chapter 36 — Prisma Access Zones

Security zones are the traffic segments that policy rules reference as source and destination. Prisma Access enforces three fixed zones — understanding their purpose and restrictions is essential before writing any security policy.

The Three Prisma Access Zones

graph TD
    MU["💻 Mobile User<br/>(GlobalProtect)"]
    RN["🏬 Remote Network<br/>(Branch IPSec)"]
    SC["🔗 Service Connection<br/>(DC / HQ)"]
    INT["🌐 Internet / SaaS"]
    CVPN["🌐 Clientless VPN<br/>(browser-based)"]

    MU & RN & SC -->|Trust zone| PA["☁️ Prisma Access"]
    INT -->|Untrust zone| PA
    CVPN -->|Trust zone<br/>(fixed)| PA

Zone Mapping

All traffic defaults to Untrust until explicitly mapped. To allow traffic from Mobile Users, Remote Networks, or Service Connections to reach corporate resources, you must create zone mappings that associate those sources with the Trust zone.

Zone mappings are configured per Prisma Access component in its respective template (Panorama) or folder (Strata Cloud Manager) — see Chapter 32 for how these concepts map to each other. The zone model itself — the three fixed zones, their trust levels, and the reserved names below — is a Prisma Access service-level construct, not something that differs between management platforms.

Reserved Zone Names — Do Not Reuse

Prisma Access uses several zone names internally. Creating a custom zone with any of these names causes conflicts and policy enforcement failures:

⚠️ Never create a custom zone named trust, untrust, or inter-fw. These names are reserved for Prisma Access internal use. Using them for custom zones corrupts zone-based policy matching and produces unpredictable security policy behaviour.

Also avoid naming your remote network sites with names that conflict with existing zone names — each remote network site name becomes a source zone identifier in logs.

Writing Policy Rules with Zones

Security policy rules in the predefined device groups use zones as source and destination:

The inter-fw zone is used by Prisma Access itself for internal SPN-to-SPN traffic — do not write rules targeting this zone unless specifically directed by PaloAlto TAC.

📷 PaloAlto diagram — Prisma Access zone overview

Key Takeaways

• Three zones: Trust (onboarded internal sources), Untrust (internet/external), Clientless VPN (fixed Trust — cannot change)
• All traffic defaults to Untrust — explicitly map Mobile Users, Remote Networks, and Service Connections to Trust
• Never create custom zones named trust, untrust, or inter-fw — these are reserved by Prisma Access
• Remote network site names become zone identifiers in logs — avoid names that conflict with reserved zone names
• Clientless VPN zone is permanently mapped to Trust and cannot be remapped

Previous: Chapter 35 — Inheritance Precedence & Predefined Templates · Next: Chapter 37 — Remote Network Templates, Device Groups & Zone Mapping