deploying-palo-alto-prisma-access-zero-trust
Lets your agent configure secure access to the corporate network. It ensures only authorized users access resources.
What it does
This tool configures secure network access for your company using Palo Alto Networks' Zero Trust technology. It helps protect employee and branch access to applications and data, replacing older methods like VPNs.
When to use it
- ✓When implementing advanced security for remote access.
- ✓When replacing branch office firewalls with cloud security.
- ✓When securely connecting remote users and branches to the company network.
Example of what to ask your AI
“Configure secure access for my company with Zero Trust.”
Want more? Open the sections below.
How to use
The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.
Skill link
Ready-to-paste message
How it works
The tool sets up Palo Alto Networks' Prisma Access, defining how users and devices connect and which applications they can access. It ensures that only authorized users and devices access necessary resources.
Installation
Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.
In the terminal (Claude Code, Codex, Cursor), in your project folder:
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill deploying-palo-alto-prisma-access-zero-trustOr download just the file:
curl -L https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/main/skills/deploying-palo-alto-prisma-access-zero-trust/SKILL.md -o SKILL.mdTechnical content (original SKILL.md)
Original text by the author, straight from GitHub.
Deploying Palo Alto Prisma Access Zero Trust
When to Use
- When implementing enterprise-grade SASE with integrated ZTNA, SWG, CASB, and FWaaS
- When replacing both VPN and branch office firewalls with cloud-delivered security
- When needing advanced threat prevention (WildFire, DNS Security) for remote access traffic
- When deploying zero trust for both mobile users and remote network (branch) connections
- When integrating ZTNA with existing Palo Alto NGFW infrastructure via Strata Cloud Manager
Do not use for small organizations (< 200 users) where simpler ZTNA solutions suffice, for environments requiring only web application access without full network security, or when budget constraints preclude enterprise SASE licensing.
Prerequisites
- Prisma Access license (Business Premium or equivalent)
- Strata Cloud Manager (SCM) tenant configured
- GlobalProtect agent for endpoint deployment
- ZTNA Connector VM: 4 vCPU, 8GB RAM, 128GB disk (VMware, AWS, Azure, or GCP)
- Identity provider: Okta, Entra ID, Ping Identity (SAML 2.0)
- Palo Alto Cortex Data Lake for log storage
Workflow
Step 1: Configure Prisma Access Infrastructure in Strata Cloud Manager
Set up the cloud infrastructure for mobile user and remote network connections.
Strata Cloud Manager > Prisma Access > Infrastructure Settings:
Mobile Users Configuration:
- Service Connection: Auto-selected based on user location
- DNS Servers: 10.1.1.10, 10.1.1.11 (corporate DNS)
- IP Pool for Mobile Users: 10.100.0.0/16
- Authentication: SAML with Okta (Primary), Entra ID (Secondary)
- GlobalProtect Portal: portal.company.com
- GlobalProtect Gateway: Auto (nearest Prisma Access location)
Infrastructure Subnet:
- Range: 172.16.0.0/16
- Allocation: /24 per Prisma Access location
Step 2: Deploy ZTNA Connectors for Private Application Access
Install ZTNA Connectors to provide secure access to internal applications.
# Deploy ZTNA Connector on VMware (OVA)
# Download OVA from Strata Cloud Manager > Prisma Access > ZTNA Connectors
# AWS deployment via CloudFormation
aws cloudformation create-stack \
--stack-name prisma-ztna-connector \
--template-url https://prisma-access-connector-templates.s3.amazonaws.com/ztna-connector-aws.yaml \
--parameters \
ParameterKey=VpcId,ParameterValue=vpc-PROD \
ParameterKey=SubnetId,ParameterValue=subnet-PRIVATE \
ParameterKey=InstanceType,ParameterValue=m5.xlarge \
ParameterKey=TenantServiceGroup,ParameterValue=TSG_ID \
ParameterKey=ConnectorName,ParameterValue=dc-east-connector-01
# Verify connector registration
# Strata Cloud Manager > Prisma Access > ZTNA Connectors
# Status should show "Connected" with nearest Prisma Access location
# Deploy second connector for HA
# ZTNA Connector auto-discovers nearest Prisma Access location
# IPSec tunnel uses: ecp384/aes256/sha512 for IKE and ESP
# Bandwidth: up to 2 Gbps per connector
Step 3: Define Application Definitions and Access Policies
Create application definitions pointing to internal applications via ZTNA Connectors.
Strata Cloud Manager > Prisma Access > Applications:
Application 1: Internal Wiki
- FQDN: wiki.internal.corp
- Port: TCP 443
- ZTNA Connector: dc-east-connector-01
- Protocol: HTTPS
- Health Check: Enabled (HTTP GET /health)
Application 2: Source Code Repository
- FQDN: git.internal.corp
- Ports: TCP 22, 443
- ZTNA Connector: dc-east-connector-01, dc-east-connector-02
- Protocol: HTTPS, SSH
Application 3: Finance ERP
- FQDN: erp.internal.corp
- Port: TCP 443
- ZTNA Connector: dc-east-connector-01
- Protocol: HTTPS
- User Authentication: Required (re-auth every 2h)
Strata Cloud Manager > Policies > Security Policy:
Rule 1: Engineering Access to Dev Tools
Source: User Group "Engineering" (from Okta SAML)
Destination: Application "Source Code Repository", "Internal Wiki"
HIP Profile: "Managed Device with CrowdStrike"
Action: Allow
Logging: Enabled
Threat Prevention: Best Practice profile
Rule 2: Finance Access to ERP
Source: User Group "Finance"
Destination: Application "Finance ERP"
HIP Profile: "Compliant Device - High Security"
Action: Allow
SSL Decryption: Forward Proxy
DLP Profile: "Financial Data Protection"
Rule 3: Default Deny Private Apps
Source: Any
Destination: Any Private App
Action: Deny
Logging: Enabled
Step 4: Configure Host Information Profile (HIP) for Device Posture
…
FAQ
What is Zero Trust?
It's a security model that assumes no person or device is trustworthy by default, requiring constant verification to access resources.
What is SASE?
SASE (Secure Access Service Edge) is a cloud security architecture that combines networking and security for secure access from any location.
Do I need specific licenses?
Yes, a Prisma Access license (Business Premium or equivalent) and other tools like Strata Cloud Manager and an identity provider (Okta, Entra ID, etc.) are required.
Details
Original description by the author
Deploys Palo Alto Networks Prisma Access for SASE-based zero trust network access, configuring GlobalProtect agents, ZTNA Connectors, security policy enforcement, and Strata Cloud Manager integration for unified management. Use when implementing enterprise-grade SASE with integrated ZTNA/SWG/CASB/FWaaS, replacing both VPN and branch firewalls with cloud-delivered security, or integrating ZTNA with
Popularity
- GitHub stars
- 35k
- Ranking position
- #5622
- License
- Apache-2.0
- Updated
- 8/31/2026
Comments
- …
More skills from this repository
abusing-dpapi-for-credential-access
Gives your AI agent ready-made instructions for a specific task, so it does it better and faster.
mukul975/Anthropic-Cybersecurity-Skills
abusing-shadow-credentials-for-privesc
Teaches your AI agent to write clear, well-structured text.
mukul975/Anthropic-Cybersecurity-Skills
achieving-cmmc-level-2-compliance
Helps your agent prepare an environment for CMMC Level 2 compliance. It implements security requirements and manages necessary documentation.
mukul975/Anthropic-Cybersecurity-Skills
acquiring-disk-image-with-dd-and-dcfldd
Helps your agent create exact copies of hard drives. This is useful for ensuring no information is lost or altered during investigations.
mukul975/Anthropic-Cybersecurity-Skills
Similar skills
bun-runtime
Has your agent use Bun to run, organize, and test code. It helps choose Bun over other tools and migrate existing projects.
affaan-m/ECC
database-migrations
Helps your agent make safe changes to databases. It ensures changes can be undone and minimizes downtime.
affaan-m/ECC
deployment-patterns
Sets up deployment and CI/CD workflows, containerization, and rollback strategies to ensure safe releases.
affaan-m/ECC