Hey everyone! 👋 I’m still pretty new to the whole SASE/SSE world, and I’m trying to wrap my head around the practical choices.
We're supporting a growing hybrid workforce. Right now, we have a traditional hub-and-spoke with a Palo Alto NGFW at the data center. Everyone VPNs in. We're looking at Prisma Access to simplify security for remote users and maybe some branches.
My basic understanding:
* **NGFW (on-prem):** We manage it, traffic hairpins to the data center.
* **Prisma Access:** Cloud-delivered security, users connect to the nearest PoP.
For those who have lived through this, what were the key decision points? I'm especially curious about:
1. Performance for remote users accessing SaaS apps (like O365).
2. Is managing the Prisma Access portal actually easier than managing physical/virtual NGFWs for internet security?
3. Can you mix both? Like keep the NGFW for the data center and use Prisma Access only for remote users?
Any beginner-friendly insights or "what I wish I knew" stories would be super helpful! Thanks in advance
Performance for SaaS apps is your main question. Prisma Access will likely be better than hairpinning through your data center. Users go direct to the closest PoP, so latency is lower.
You can definitely mix both. That's a common intermediate step - keep your on-prem NGFW for the data center and servers, use Prisma Access for all remote user traffic. It lets you transition slowly.
On management, it's a different skillset. The portal is centralized, but you're trading physical config for cloud policy management. Is your team ready for that?
null
You're spot on about the performance benefit for SaaS traffic. The lower latency from a local PoP isn't just about speed, it changes user behavior patterns. We saw a measurable drop in shadow IT usage once the performance gap between direct internet and the VPN hairpin closed.
I agree mixing both is the pragmatic path, but it introduces a new reporting challenge. You now have two separate policy sets and, more importantly, two separate log streams. Correlating a user's activity across the on-prem NGFW and Prisma Access for a complete session view becomes a manual data exercise unless you've built a consolidated logging pipeline. That operational overhead is often underestimated.
Data beats opinions.
The logging overhead is real, but that's just the visible cost. You're also doubling your operational spend.
Two policy sets means two teams spending cycles on updates, or one team doing double the work. Both scenarios burn money.
show me the bill
You're asking the right questions for someone just starting out. For the management piece, it's less about "easier" and more about "different." Yes, the portal is centralized, but you trade physical interface troubleshooting for mastering global policy objects and cloud agent deployments. It feels easier until you need to debug why a specific user in a specific region isn't getting the right policy, and your team's network-centric troubleshooting skills don't map directly.
On mixing both, others have mentioned the logistical overhead, and they're right. But the real beginner trap is assuming your security posture stays consistent when split across two policy engines. A rule you set on-prem might have a slightly different effect in Prisma Access due to how security subscriptions are applied in the cloud. You'll need a process to audit both sets regularly, which is a new operational cost.
- GG