SSE-Engineer Exam Dumps : Palo Alto Networks Security Service Edge Engineer

SincePhase 1 of the IPSec tunnel is establishedbutPhase 2 traffic is not being received, theTunnel logsinStrata Logging Serviceshould be reviewed.Tunnel logsprovide visibility into IPSec tunnel establishment,Phase 2 negotiation, and any errors or dropped packets related to encrypted traffic. This will help identify whetherESP (Encapsulating Security Payload) traffic is being blocked, mismatched security associations (SAs) exist, or if there are other issues with Prisma Access responding to Phase 2-encrypted packets.

In Prisma Access's default routing mode, the service connections establish BGP sessions with the customer premises equipment (CPE) in the data centers. To ensure traffic destined for mobile users in a specific region (e.g., North America) traverses the service connection in that same region, you need to control the route advertisements.

Filtering out the mobile user pool prefixes from the other region on each service connection achieves this by:

Preventing the data center in one region from learning the specific mobile user prefixes of the other region.For example, the North American service connection would filter out the mobile user pool prefixes allocated to European users.

Ensuring that when a data center needs to send traffic to a mobile user, it will only see and use the route advertised by the service connection in the appropriate geographical region.This forces the traffic to enter the Prisma Access infrastructure through the intended regional service connection.

Let's analyze why the other options are incorrect based on official documentation regarding default routing mode:

A. Configure BGP on the customer premises equipment (CPE) to prefer the assigned community string attribute on the mobile user prefixes in its respective Prisma Access region.While BGP communities can be used for influencing routing decisions, in the context ofdefault routing modeand ensuring regional traffic flow, relying solely on the CPE to prefer community strings might not be the most robust or direct method to guarantee traffic traverses the correct regional service connection. The service connection itself needs to control the advertisement of prefixes.

C. Configure BGP on the customer premises equipment (CPE) to prefer the MED attribute on the mobile user prefixes in its respective Prisma Access region.The BGP MED (Multi-Exit Discriminator) attribute is primarily used to influence the path selectionbetweenautonomous systems (AS) or within the same AS at different entry points. In this scenario, where serviceconnections are advertising prefixes, filtering at the source (service connection) is a more direct and reliable way to ensure regional traffic flow than relying on the MED attribute on the CPE.

D. Configure each service connection to prepend the BGP ASN five times for mobile user pool prefixes originating from the other region.BGP AS path prepending is a mechanism to make a path less desirable. While this could influence routing, it doesn't guarantee that traffic will always take the intended regional path. Filtering provides a more definitive control over which routes are advertised and learned.

Therefore, configuring each service connection to filter out the mobile user pool prefixes from the other region in the advertisements to the data center is the verified method to ensure traffic destined for mobile users traverses the service connection in the appropriate region when using Prisma Access in default routing mode.

TheCommand CenterwithinStrata Cloud Manager (SCM)provides acentralized view of applications, threats, and user insightsacross bothNGFW (Next-Generation Firewall) and Prisma Accesssimultaneously. This feature enables theoperations teamto monitorbranch locations, analyzesecurity events, and detect anomalies in real time, offering acomprehensive visibility and threat intelligence interfacefor proactive network and security management.