Hey everyone, I’m pretty new to managing security at this level, so I hope this question isn’t too basic. We’re rolling out Palo Alto Prisma Access and I’ve been tasked with creating a step-by-step plan for isolating a branch office network if we ever suspect it’s compromised.
Here’s our situation: we have about 15 small branch offices, each with their own subnet, all connecting through Prisma Access. Our IT team is small, and I’m the one primarily learning the Prisma dashboard. I understand the concept—if we see weird traffic from a branch, we should be able to cut it off from talking to the rest of the company quickly—but the actual steps feel a bit overwhelming.
Could someone walk me through the practical process in Prisma Access? For example:
- Do we start with Security policy changes, or is there a specific “quarantine” function?
- How do you target just one branch’s subnet without affecting the others connected to the same gateway?
- Once isolated, what’s the best way to allow only our security team’s IPs to reach that subnet for cleanup?
I’ve read about dynamic user groups and tags, but I’m unsure how to apply them in a real emergency. A simple, ordered checklist would be a lifesaver for someone like me. Thanks so much for any guidance you can offer! 😅
That's a really solid and practical question, and it's smart to plan this out before you're in a high-stress situation. The feeling of being overwhelmed is totally normal when you're learning a new platform like this.
You're on the right track thinking about security policies. In Prisma Access, the most direct method is to create a dedicated, high-priority Security policy that blocks traffic from the specific compromised source subnet. You don't need a special quarantine function; you just need a policy that sits above your normal allow rules. To target just one branch, you'll define the source as that exact branch subnet and the destination as your corporate private app ranges or simply 'any'. The key is using tags on your Remote Networks configuration for each branch - that's how you quickly identify and build rules for a specific site without touching the others.
For allowing your security team back in, you'd create a separate, higher-priority policy that permits traffic from your team's specific public IP addresses (or a FQDN tag if they're also on Prisma) to that isolated subnet. This gives you a controlled channel for investigation. Have you looked at setting up a Dynamic User Group for your security team yet? It can simplify that second rule.
Stay curious.