Secure cloud access for remote users with Alkira and PAN GlobalProtect

In this blog, I am excited to share details about the integration of Palo Alto Networks (PAN) Global Protect VPN service with Alkira Network cloud. It enables our joint customers to configure Global Protect inside Alkira Cloud Exchange Points (CXP). This will enable them to securely access applications hosted in public cloud, on-prem data centers or on the internet. Integration of PAN VM series on the Alkira platform has been there since we launched our service. Customers have been using it to inspect on-prem to cloud, on-prem to internet, cloud to cloud or cloud to internet type of traffic. However, for remote users they had to configure Global Protect elsewhere like inside the datacenter DMZ.

This integration will allow customers to leverage the same or a dedicated cloud firewall deployed inside Alkira CXPs to terminate remote users. As part of this integration Alkira will take care of provisioning of the infrastructure components like physical and tunnel interfaces required, automatically stitching connectivity with CXPs, lifecycle management of the VM, and operational visibility.

Customers will have full control over firewall configuration like security policies, integration with their enterprise authentication infrastructure and Global Protect configurations. They can also integrate and control firewalls through their existing Panorama and can configure on-demand autoscale capability as well.

Due to a much superior architecture, PAN Global Protect and Alkira offers a lot of benefits to our customers over the traditional data center based remote access solutions. Some of the main benefits of this integration are listed below.

1) Lower latency when accessing cloud applications

PAN firewalls are hosted inside Alkira CXPs. CXPs are virtual points of presence which are globally distributed, interconnected over high bandwidth and low latency infrastructure. Remote users terminate to the closest CXP so that the users accessing the applications have the lowest latency for the last mile getting to the cloud exchange point and from there they can be on a low latency backbone to connect into workloads hosted in any cloud region. This architecture provides optimal latency compared to an architecture without Alkira where you typically backhaul the traffic all the way to the data center to terminate the remote users.

2) Segmentation: Securely Map Users to Cloud Workloads

Segmentation has always been tough and challenging inside the cloud as cloud native constructs are mainly architected to establish connectivity. Isolating networks using VRFs is not natively available inside the cloud. However, from a security and compliance perspective it is a requirement to isolate different purpose networks from each other. Alkira, through its network cloud offering, provides the ability to its customers to seamlessly extend all their segments into the cloud from their data centers and branches. With support for Global Protect, we are extending the same segmentation capabilities to remote users as well. Customers can have different Global Protect configurations for each segment configured inside the CXP which then maps to workload/applications inside the cloud or data centers.

3) Build for zero trust

The integration is built for zero trust. By default all traffic from remote users to cloud, datacenter and internet is blocked unless there is an explicit policy configured on the firewall to allow traffic towards the destination. This policy will be an inter-zone policy as the Global Protect users will always be terminated in a separate zone compared to other applications.

Conclusion

Palo Alto global protect service running inside Alkira CXPs is great for our customers as the architecture aligns very well with the performance and security requirements for modern day applications.

If you like to a see a quick demo, please reach out to sales@alkira.com