[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71AX3MHK7BZ2K0TPB71JMQT":3,"skill-same:01M71AX3MHK7BZ2K0TPB71JMQT":68},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":6,"ownerDescription":53,"updatedAt":54,"install":55,"resources":67},"01M71AX3MHK7BZ2K0TPB71JMQT","cyber-deploying-palo-alto-prisma-access-zero-trust",null,"Deploying Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager for unified security management.","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-deploying-palo-alto-prisma-access-zero-trust\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"prisma","deploying palo alto prisma access zero trust","zero trust","trust","ZeRO","cyber deploying palo alto prisma access zero trust","access","network","sase","strata-cloud-manager","security management","globalprotect","palo-alto","prisma-access","ztna","zero-trust","subdomain","architecture","false","cybersecurity","2026-11-10 10:12:30",false,"---\nname: cyber-deploying-palo-alto-prisma-access-zero-trust\ndescription: \"Deploying Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager for unified security management.\"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: false\norigin_frontmatter: \"name: deploying-palo-alto-prisma-access-zero-trust | description: 'Deploying Palo Alto Networks Prisma Access for SASE-based zero trust |   network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, |   and integration with Strata Cloud Manager for unified security management. |  |   ' | domain: cybersecurity | subdomain: zero-trust-architecture | tags: | - prisma-access | - palo-alto | - ztna | - sase | - globalprotect | - strata-cloud-manager | - zero-trust | vers\"\nhide: true\n---\n\n> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Deploying Palo Alto Prisma Access Zero Trust\n\n## When to Use\n\n- When implementing enterprise-grade SASE with integrated ZTNA, SWG, CASB, and FWaaS\n- When replacing both VPN and branch office firewalls with cloud-delivered security\n- When needing advanced threat prevention (WildFire, DNS Security) for remote access traffic\n- When deploying zero trust for both mobile users and remote network (branch) connections\n- When integrating ZTNA with existing Palo Alto NGFW infrastructure via Strata Cloud Manager\n\n**Do not use** for small organizations (\u003C 200 users) where simpler ZTNA solutions suffice, for environments requiring only web application access without full network security, or when budget constraints preclude enterprise SASE licensing.\n\n## Prerequisites\n\n- Prisma Access license (Business Premium or equivalent)\n- Strata Cloud Manager (SCM) tenant configured\n- GlobalProtect agent for endpoint deployment\n- ZTNA Connector VM: 4 vCPU, 8GB RAM, 128GB disk (VMware, AWS, Azure, or GCP)\n- Identity provider: Okta, Entra ID, Ping Identity (SAML 2.0)\n- Palo Alto Cortex Data Lake for log storage\n\n## Workflow\n\n### Step 1: Configure Prisma Access Infrastructure in Strata Cloud Manager\n\nSet up the cloud infrastructure for mobile user and remote network connections.\n\n```text\nStrata Cloud Manager > Prisma Access > Infrastructure Settings:\n\nMobile Users Configuration:\n  - Service Connection: Auto-selected based on user location\n  - DNS Servers: 10.1.1.10, 10.1.1.11 (corporate DNS)\n  - IP Pool for Mobile Users: 10.100.0.0\u002F16\n  - Authentication: SAML with Okta (Primary), Entra ID (Secondary)\n  - GlobalProtect Portal: portal.company.com\n  - GlobalProtect Gateway: Auto (nearest Prisma Access location)\n\nInfrastructure Subnet:\n  - Range: 172.16.0.0\u002F16\n  - Allocation: \u002F24 per Prisma Access location\n```\n\n### Step 2: Deploy ZTNA Connectors for Private Application Access\n\nInstall ZTNA Connectors to provide secure access to internal applications.\n\n```bash\n# Deploy ZTNA Connector on VMware (OVA)\n# Download OVA from Strata Cloud Manager > Prisma Access > ZTNA Connectors\n\n# AWS deployment via CloudFormation\naws cloudformation create-stack \\\n  --stack-name prisma-ztna-connector \\\n  --template-url https:\u002F\u002Fprisma-access-connector-templates.s3.amazonaws.com\u002Fztna-connector-aws.yaml \\\n  --parameters \\\n    ParameterKey=VpcId,ParameterValue=vpc-PROD \\\n    ParameterKey=SubnetId,ParameterValue=subnet-PRIVATE \\\n    ParameterKey=InstanceType,ParameterValue=m5.xlarge \\\n    ParameterKey=TenantServiceGroup,ParameterValue=TSG_ID \\\n    ParameterKey=ConnectorName,ParameterValue=dc-east-connector-01\n\n# Verify connector registration\n# Strata Cloud Manager > Prisma Access > ZTNA Connectors\n# Status should show \"Connected\" with nearest Prisma Access location\n\n# Deploy second connector for HA\n# ZTNA Connector auto-discovers nearest Prisma Access location\n# IPSec tunnel uses: ecp384\u002Faes256\u002Fsha512 for IKE and ESP\n# Bandwidth: up to 2 Gbps per connector\n```\n\n### Step 3: Define Application Definitions and Access Policies\n\nCreate application definitions pointing to internal applications via ZTNA Connectors.\n\n```text\nStrata Cloud Manager > Prisma Access > Applications:\n\nApplication 1: Internal Wiki\n  - FQDN: wiki.internal.corp\n  - Port: TCP 443\n  - ZTNA Connector: dc-east-connector-01\n  - Protocol: HTTPS\n  - Health Check: Enabled (HTTP GET \u002Fhealth)\n\nApplication 2: Source Code Repository\n  - FQDN: git.internal.corp\n  - Ports: TCP 22, 443\n  - ZTNA Connector: dc-east-connector-01, dc-east-connector-02\n  - Protocol: HTTPS, SSH\n\nApplication 3: Finance ERP\n  - FQDN: erp.internal.corp\n  - Port: TCP 443\n  - ZTNA Connector: dc-east-connector-01\n  - Protocol: HTTPS\n  - User Authentication: Required (re-auth every 2h)\n\nStrata Cloud Manager > Policies > Security Policy:\n\nRule 1: Engineering Access to Dev Tools\n  Source: User Group \"Engineering\" (from Okta SAML)\n  Destination: Application \"Source Code Repository\", \"Internal Wiki\"\n  HIP Profile: \"Managed Device with CrowdStrike\"\n  Action: Allow\n  Logging: Enabled\n  Threat Prevention: Best Practice profile\n\nRule 2: Finance Access to ERP\n  Source: User Group \"Finance\"\n  Destination: Application \"Finance ERP\"\n  HIP Profile: \"Compliant Device - High Security\"\n  Action: Allow\n  SSL Decryption: Forward Proxy\n  DLP Profile: \"Financial Data Protection\"\n\nRule 3: Default Deny Private Apps\n  Source: Any\n  Destination: Any Private App\n  Action: Deny\n  Logging: Enabled\n```\n\n### Step 4: Configure Host Information Profile (HIP) for Device Posture\n\nDefine device posture requirements using HIP checks.\n\n```text\nStrata Cloud Manager > Objects > GlobalProtect > HIP Objects:\n\nHIP Object: \"CrowdStrike Running\"\n  - Vendor: CrowdStrike\n  - Product: Falcon Sensor\n  - Is Running: Yes\n  - Minimum Version: 7.10\n\nHIP Object: \"Disk Encryption Enabled\"\n  - Windows: BitLocker = Encrypted\n  - macOS: FileVault = Encrypted\n\nHIP Object: \"OS Patch Level\"\n  - Windows: >= 10.0.22631\n  - macOS: >= 14.0\n\nHIP Profile: \"Managed Device with CrowdStrike\"\n  - Match: \"CrowdStrike Running\" AND \"Disk Encryption Enabled\"\n\nHIP Profile: \"Compliant Device - High Security\"\n  - Match: \"CrowdStrike Running\" AND \"Disk Encryption Enabled\" AND \"OS Patch Level\"\n```\n\n### Step 5: Deploy GlobalProtect Agent to Endpoints\n\nRoll out the GlobalProtect agent for secure connectivity.\n\n```bash\n# Deploy GlobalProtect via Intune (Windows)\n# MSI download from Strata Cloud Manager > GlobalProtect > Agent Downloads\n\n# GlobalProtect pre-deployment configuration\n# pre-deploy.xml for automated portal connection:\ncat > pre-deploy.xml \u003C\u003C 'EOF'\n\u003CGlobalProtect>\n  \u003CSettings>\n    \u003Cportal>portal.company.com\u003C\u002Fportal>\n    \u003Cconnect-method>pre-logon\u003C\u002Fconnect-method>\n    \u003Cauthentication-override>\n      \u003Cgenerate-cookie>yes\u003C\u002Fgenerate-cookie>\n      \u003Ccookie-lifetime>24\u003C\u002Fcookie-lifetime>\n    \u003C\u002Fauthentication-override>\n  \u003C\u002FSettings>\n\u003C\u002FGlobalProtect>\nEOF\n\n# Verify GlobalProtect connection status\n# GlobalProtect system tray > Settings > Connection Details\n# Should show: Connected to nearest Prisma Access gateway\n# IPSec tunnel established with full threat prevention\n```\n\n### Step 6: Configure Logging and Monitoring\n\nSet up Cortex Data Lake integration and monitoring dashboards.\n\n```text\nStrata Cloud Manager > Prisma Access > Monitoring:\n\nLog Forwarding:\n  - Cortex Data Lake: Enabled (all log types)\n  - SIEM Forwarding: Splunk HEC (https:\u002F\u002Fsplunk-hec.company.com:8088)\n  - Log Types: Traffic, Threat, URL, WildFire, GlobalProtect, HIP Match\n\nDashboard Monitoring:\n  - Mobile Users: Active connections, locations, bandwidth\n  - ZTNA Connectors: Health, latency, tunnel status\n  - Security Events: Threats blocked, DLP violations, HIP failures\n  - Application Usage: Top apps, top users, denied access attempts\n\nAlerting:\n  - ZTNA Connector down: Email + PagerDuty\n  - HIP failure rate > 10%: Email to IT\n  - Threat detected on mobile user: SOC alert\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Prisma Access | Palo Alto's cloud-delivered SASE platform providing FWaaS, SWG, CASB, DLP, and ZTNA from a single architecture |\n| ZTNA Connector | VM-based connector establishing IPSec tunnels from internal networks to Prisma Access for private application access |\n| GlobalProtect | Endpoint agent providing secure connectivity to Prisma Access with HIP checks and always-on VPN |\n| Host Information Profile (HIP) | Device posture checks evaluating endpoint security state (EDR, encryption, patches) before granting access |\n| Strata Cloud Manager | Unified management console for Prisma Access, NGFW, and Prisma Cloud security policy |\n| Cortex Data Lake | Cloud-based log storage and analytics platform for Palo Alto security telemetry |\n\n## Tools & Systems\n\n- **Prisma Access**: Cloud-delivered SASE with integrated ZTNA, SWG, CASB, DLP, FWaaS\n- **Strata Cloud Manager (SCM)**: Unified policy management across Palo Alto security products\n- **GlobalProtect Agent**: Endpoint connectivity agent with HIP data collection\n- **ZTNA Connector**: Outbound-only tunnel connector for internal application access\n- **Cortex Data Lake**: Centralized log storage with analytics and threat detection\n- **WildFire**: Cloud-based malware analysis and prevention integrated with Prisma Access\n\n## Common Scenarios\n\n### Scenario: Enterprise SASE Migration for 5,000-User Organization\n\n**Context**: A manufacturing company with 5,000 users across 15 offices is consolidating VPN, SWG, and branch firewalls into Prisma Access SASE. Users access 50+ internal applications and need consistent security regardless of location.\n\n**Approach**:\n1. Deploy ZTNA Connectors at 3 data centers (2 per DC for HA) for internal application access\n2. Configure GlobalProtect with pre-logon connection for always-on security\n3. Define 50+ application definitions in SCM with FQDN and port mappings\n4. Create HIP profiles: Standard (encryption + AV), Enhanced (+ CrowdStrike + patches)\n5. Build security policies mapping user groups to applications with HIP requirements\n6. Enable threat prevention profiles (Anti-Spyware, Anti-Virus, WildFire, URL Filtering)\n7. Deploy GlobalProtect agent via SCCM to all 5,000 endpoints in phases\n8. Configure Cortex Data Lake forwarding to Splunk for SOC monitoring\n9. Decommission VPN concentrators and branch firewall appliances\n\n**Pitfalls**: ZTNA Connector requires minimum 4 vCPU and 8GB RAM; under-provisioning causes latency. GlobalProtect pre-logon requires machine certificates for authentication before user login. HIP check intervals should be 60 seconds minimum to avoid performance impact. Plan for a 4-6 week pilot before full deployment.\n\n## Output Format\n\n```\nPrisma Access ZTNA Deployment Report\n==================================================\nOrganization: ManufactureCorp\nDeployment Date: 2026-02-23\n\nINFRASTRUCTURE:\n  ZTNA Connectors: 6 (2x DC-East, 2x DC-West, 2x DC-EU)\n  Prisma Access Locations: 8 (auto-selected)\n  GlobalProtect Portal: portal.manufacturecorp.com\n\nAPPLICATION ACCESS:\n  Defined Applications: 52\n  Active ZTNA Connections: 3,247\n  Average Latency: 12ms\n\nENDPOINT DEPLOYMENT:\n  GlobalProtect Deployed: 4,812 \u002F 5,000 (96.2%)\n  HIP Compliant: 4,567 \u002F 4,812 (94.9%)\n  HIP Failures: 245 (top: missing patches 120, encryption 85)\n\nSECURITY (last 30 days):\n  Threats Blocked: 1,234\n  DLP Violations: 89\n  URL Blocked: 45,678\n  WildFire Submissions: 2,345\n```\n","> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Deploying Palo Alto Prisma Access Zero Trust\n\n## When to Use\n\n- When implementing enterprise-grade SASE with integrated ZTNA, SWG, CASB, and FWaaS\n- When replacing both VPN and branch office firewalls with cloud-delivered security\n- When needing advanced threat prevention (WildFire, DNS Security) for remote access traffic\n- When deploying zero trust for both mobile users and remote network (branch) connections\n- When integrating ZTNA with existing Palo Alto NGFW infrastructure via Strata Cloud Manager\n\n**Do not use** for small organizations (\u003C 200 users) where simpler ZTNA solutions suffice, for environments requiring only web application access without full network security, or when budget constraints preclude enterprise SASE licensing.\n\n## Prerequisites\n\n- Prisma Access license (Business Premium or equivalent)\n- Strata Cloud Manager (SCM) tenant configured\n- GlobalProtect agent for endpoint deployment\n- ZTNA Connector VM: 4 vCPU, 8GB RAM, 128GB disk (VMware, AWS, Azure, or GCP)\n- Identity provider: Okta, Entra ID, Ping Identity (SAML 2.0)\n- Palo Alto Cortex Data Lake for log storage\n\n## Workflow\n\n### Step 1: Configure Prisma Access Infrastructure in Strata Cloud Manager\n\nSet up the cloud infrastructure for mobile user and remote network connections.\n\n```text\nStrata Cloud Manager > Prisma Access > Infrastructure Settings:\n\nMobile Users Configuration:\n  - Service Connection: Auto-selected based on user location\n  - DNS Servers: 10.1.1.10, 10.1.1.11 (corporate DNS)\n  - IP Pool for Mobile Users: 10.100.0.0\u002F16\n  - Authentication: SAML with Okta (Primary), Entra ID (Secondary)\n  - GlobalProtect Portal: portal.company.com\n  - GlobalProtect Gateway: Auto (nearest Prisma Access location)\n\nInfrastructure Subnet:\n  - Range: 172.16.0.0\u002F16\n  - Allocation: \u002F24 per Prisma Access location\n```\n\n### Step 2: Deploy ZTNA Connectors for Private Application Access\n\nInstall ZTNA Connectors to provide secure access to internal applications.\n\n```bash\n# Deploy ZTNA Connector on VMware (OVA)\n# Download OVA from Strata Cloud Manager > Prisma Access > ZTNA Connectors\n\n# AWS deployment via CloudFormation\naws cloudformation create-stack \\\n  --stack-name prisma-ztna-connector \\\n  --template-url https:\u002F\u002Fprisma-access-connector-templates.s3.amazonaws.com\u002Fztna-connector-aws.yaml \\\n  --parameters \\\n    ParameterKey=VpcId,ParameterValue=vpc-PROD \\\n    ParameterKey=SubnetId,ParameterValue=subnet-PRIVATE \\\n    ParameterKey=InstanceType,ParameterValue=m5.xlarge \\\n    ParameterKey=TenantServiceGroup,ParameterValue=TSG_ID \\\n    ParameterKey=ConnectorName,ParameterValue=dc-east-connector-01\n\n# Verify connector registration\n# Strata Cloud Manager > Prisma Access > ZTNA Connectors\n# Status should show \"Connected\" with nearest Prisma Access location\n\n# Deploy second connector for HA\n# ZTNA Connector auto-discovers nearest Prisma Access location\n# IPSec tunnel uses: ecp384\u002Faes256\u002Fsha512 for IKE and ESP\n# Bandwidth: up to 2 Gbps per connector\n```\n\n### Step 3: Define Application Definitions and Access Policies\n\nCreate application definitions pointing to internal applications via ZTNA Connectors.\n\n```text\nStrata Cloud Manager > Prisma Access > Applications:\n\nApplication 1: Internal Wiki\n  - FQDN: wiki.internal.corp\n  - Port: TCP 443\n  - ZTNA Connector: dc-east-connector-01\n  - Protocol: HTTPS\n  - Health Check: Enabled (HTTP GET \u002Fhealth)\n\nApplication 2: Source Code Repository\n  - FQDN: git.internal.corp\n  - Ports: TCP 22, 443\n  - ZTNA Connector: dc-east-connector-01, dc-east-connector-02\n  - Protocol: HTTPS, SSH\n\nApplication 3: Finance ERP\n  - FQDN: erp.internal.corp\n  - Port: TCP 443\n  - ZTNA Connector: dc-east-connector-01\n  - Protocol: HTTPS\n  - User Authentication: Required (re-auth every 2h)\n\nStrata Cloud Manager > Policies > Security Policy:\n\nRule 1: Engineering Access to Dev Tools\n  Source: User Group \"Engineering\" (from Okta SAML)\n  Destination: Application \"Source Code Repository\", \"Internal Wiki\"\n  HIP Profile: \"Managed Device with CrowdStrike\"\n  Action: Allow\n  Logging: Enabled\n  Threat Prevention: Best Practice profile\n\nRule 2: Finance Access to ERP\n  Source: User Group \"Finance\"\n  Destination: Application \"Finance ERP\"\n  HIP Profile: \"Compliant Device - High Security\"\n  Action: Allow\n  SSL Decryption: Forward Proxy\n  DLP Profile: \"Financial Data Protection\"\n\nRule 3: Default Deny Private Apps\n  Source: Any\n  Destination: Any Private App\n  Action: Deny\n  Logging: Enabled\n```\n\n### Step 4: Configure Host Information Profile (HIP) for Device Posture\n\nDefine device posture requirements using HIP checks.\n\n```text\nStrata Cloud Manager > Objects > GlobalProtect > HIP Objects:\n\nHIP Object: \"CrowdStrike Running\"\n  - Vendor: CrowdStrike\n  - Product: Falcon Sensor\n  - Is Running: Yes\n  - Minimum Version: 7.10\n\nHIP Object: \"Disk Encryption Enabled\"\n  - Windows: BitLocker = Encrypted\n  - macOS: FileVault = Encrypted\n\nHIP Object: \"OS Patch Level\"\n  - Windows: >= 10.0.22631\n  - macOS: >= 14.0\n\nHIP Profile: \"Managed Device with CrowdStrike\"\n  - Match: \"CrowdStrike Running\" AND \"Disk Encryption Enabled\"\n\nHIP Profile: \"Compliant Device - High Security\"\n  - Match: \"CrowdStrike Running\" AND \"Disk Encryption Enabled\" AND \"OS Patch Level\"\n```\n\n### Step 5: Deploy GlobalProtect Agent to Endpoints\n\nRoll out the GlobalProtect agent for secure connectivity.\n\n```bash\n# Deploy GlobalProtect via Intune (Windows)\n# MSI download from Strata Cloud Manager > GlobalProtect > Agent Downloads\n\n# GlobalProtect pre-deployment configuration\n# pre-deploy.xml for automated portal connection:\ncat > pre-deploy.xml \u003C\u003C 'EOF'\n\u003CGlobalProtect>\n  \u003CSettings>\n    \u003Cportal>portal.company.com\u003C\u002Fportal>\n    \u003Cconnect-method>pre-logon\u003C\u002Fconnect-method>\n    \u003Cauthentication-override>\n      \u003Cgenerate-cookie>yes\u003C\u002Fgenerate-cookie>\n      \u003Ccookie-lifetime>24\u003C\u002Fcookie-lifetime>\n    \u003C\u002Fauthentication-override>\n  \u003C\u002FSettings>\n\u003C\u002FGlobalProtect>\nEOF\n\n# Verify GlobalProtect connection status\n# GlobalProtect system tray > Settings > Connection Details\n# Should show: Connected to nearest Prisma Access gateway\n# IPSec tunnel established with full threat prevention\n```\n\n### Step 6: Configure Logging and Monitoring\n\nSet up Cortex Data Lake integration and monitoring dashboards.\n\n```text\nStrata Cloud Manager > Prisma Access > Monitoring:\n\nLog Forwarding:\n  - Cortex Data Lake: Enabled (all log types)\n  - SIEM Forwarding: Splunk HEC (https:\u002F\u002Fsplunk-hec.company.com:8088)\n  - Log Types: Traffic, Threat, URL, WildFire, GlobalProtect, HIP Match\n\nDashboard Monitoring:\n  - Mobile Users: Active connections, locations, bandwidth\n  - ZTNA Connectors: Health, latency, tunnel status\n  - Security Events: Threats blocked, DLP violations, HIP failures\n  - Application Usage: Top apps, top users, denied access attempts\n\nAlerting:\n  - ZTNA Connector down: Email + PagerDuty\n  - HIP failure rate > 10%: Email to IT\n  - Threat detected on mobile user: SOC alert\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Prisma Access | Palo Alto's cloud-delivered SASE platform providing FWaaS, SWG, CASB, DLP, and ZTNA from a single architecture |\n| ZTNA Connector | VM-based connector establishing IPSec tunnels from internal networks to Prisma Access for private application access |\n| GlobalProtect | Endpoint agent providing secure connectivity to Prisma Access with HIP checks and always-on VPN |\n| Host Information Profile (HIP) | Device posture checks evaluating endpoint security state (EDR, encryption, patches) before granting access |\n| Strata Cloud Manager | Unified management console for Prisma Access, NGFW, and Prisma Cloud security policy |\n| Cortex Data Lake | Cloud-based log storage and analytics platform for Palo Alto security telemetry |\n\n## Tools & Systems\n\n- **Prisma Access**: Cloud-delivered SASE with integrated ZTNA, SWG, CASB, DLP, FWaaS\n- **Strata Cloud Manager (SCM)**: Unified policy management across Palo Alto security products\n- **GlobalProtect Agent**: Endpoint connectivity agent with HIP data collection\n- **ZTNA Connector**: Outbound-only tunnel connector for internal application access\n- **Cortex Data Lake**: Centralized log storage with analytics and threat detection\n- **WildFire**: Cloud-based malware analysis and prevention integrated with Prisma Access\n\n## Common Scenarios\n\n### Scenario: Enterprise SASE Migration for 5,000-User Organization\n\n**Context**: A manufacturing company with 5,000 users across 15 offices is consolidating VPN, SWG, and branch firewalls into Prisma Access SASE. Users access 50+ internal applications and need consistent security regardless of location.\n\n**Approach**:\n1. Deploy ZTNA Connectors at 3 data centers (2 per DC for HA) for internal application access\n2. Configure GlobalProtect with pre-logon connection for always-on security\n3. Define 50+ application definitions in SCM with FQDN and port mappings\n4. Create HIP profiles: Standard (encryption + AV), Enhanced (+ CrowdStrike + patches)\n5. Build security policies mapping user groups to applications with HIP requirements\n6. Enable threat prevention profiles (Anti-Spyware, Anti-Virus, WildFire, URL Filtering)\n7. Deploy GlobalProtect agent via SCCM to all 5,000 endpoints in phases\n8. Configure Cortex Data Lake forwarding to Splunk for SOC monitoring\n9. Decommission VPN concentrators and branch firewall appliances\n\n**Pitfalls**: ZTNA Connector requires minimum 4 vCPU and 8GB RAM; under-provisioning causes latency. GlobalProtect pre-logon requires machine certificates for authentication before user login. HIP check intervals should be 60 seconds minimum to avoid performance impact. Plan for a 4-6 week pilot before full deployment.\n\n## Output Format\n\n```\nPrisma Access ZTNA Deployment Report\n==================================================\nOrganization: ManufactureCorp\nDeployment Date: 2026-02-23\n\nINFRASTRUCTURE:\n  ZTNA Connectors: 6 (2x DC-East, 2x DC-West, 2x DC-EU)\n  Prisma Access Locations: 8 (auto-selected)\n  GlobalProtect Portal: portal.manufacturecorp.com\n\nAPPLICATION ACCESS:\n  Defined Applications: 52\n  Active ZTNA Connections: 3,247\n  Average Latency: 12ms\n\nENDPOINT DEPLOYMENT:\n  GlobalProtect Deployed: 4,812 \u002F 5,000 (96.2%)\n  HIP Compliant: 4,567 \u002F 4,812 (94.9%)\n  HIP Failures: 245 (top: missing patches 120, encryption 85)\n\nSECURITY (last 30 days):\n  Threats Blocked: 1,234\n  DLP Violations: 89\n  URL Blocked: 45,678\n  WildFire Submissions: 2,345\n```\n",{"hide":44,"name":5,"source":45,"license":15,"description":7,"authorized_lab":40,"origin_frontmatter":46},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","name: deploying-palo-alto-prisma-access-zero-trust | description: 'Deploying Palo Alto Networks Prisma Access for SASE-based zero trust |   network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, |   and integration with Strata Cloud Manager for unified security management. |  |   ' | domain: cybersecurity | subdomain: zero-trust-architecture | tags: | - prisma-access | - palo-alto | - ztna | - sase | - globalprotect | - strata-cloud-manager | - zero-trust | vers","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills\u002Fcyber-deploying-palo-alto-prisma-access-zero-trust",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-10-27 02:18:29",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":44},[57,60,63],{"tool":58,"command":59},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-deploying-palo-alto-prisma-access-zero-trust",{"tool":61,"command":62},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-deploying-palo-alto-prisma-access-zero-trust",{"tool":64,"command":65},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-deploying-palo-alto-prisma-access-zero-trust","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-deploying-palo-alto-prisma-access-zero-trust\u002FSKILL.md",[],[69,93,116,146,175,194],{"skillNo":70,"name":71,"nameZh":6,"description":72,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":76,"publishedAt":39},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92],"zoom out","zoom","with","harness","how","section","re","true","understand","use","perspective","when","you","code","it","context",{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":39},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[100,101,80,102,103,104,105,106,107,108,109,86,110,88,111,112,36,113,114,115],"yuri shura","parallel","architecture review","planning","for","deployment","vector","strategic review","decision","strategic","ops","workflow","decisions","review","perspectives","adversarial",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":127,"publishedAt":39},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[122],{"categoryNo":123,"categoryName":124,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",[128,129,130,131,132,133,134,135,136,88,137,138,139,140,141,142,143,104,144,145],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","social","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","email","cold outreach","frame",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":160,"publishedAt":39},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[152,155],{"categoryNo":153,"categoryName":154,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":156,"categoryName":157,"taxonomyType":158,"taxonomyTypeDesc":159},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[161,90,162,128,80,163,164,165,104,166,167,168,169,170,171,172,173,174,86,88],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","techniques","improve","design",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":181,"publishedAt":39},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[182,183,184,185,186,187,188,189,190,88,191,111,192,193],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","engineering","agentic","user",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":73,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":212,"publishedAt":39},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[200,203,206,209],{"categoryNo":201,"categoryName":202,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":204,"categoryName":205,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":207,"categoryName":208,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":210,"categoryName":211,"taxonomyType":158,"taxonomyTypeDesc":159},"01JBSEEDCAT000000000000036","内容创作者",[213,214,215,88,111,216,80,217,105,86,218],"writing","writing skills","new","work","editing","Existing"]