Prisma Access removes the appliance, but it does not remove the need for high-availability design. At enterprise scale — dozens of sites, multiple data centres, thousands of mobile users — resilience is a property of how you lay out service connections, gateways and routing, not something the platform grants automatically. This guide covers the patterns we apply on large Prisma Access estates.
Redundant service connections are the foundation
A service connection is how Prisma Access reaches your private applications, whether they sit in a data centre or a cloud VPC. Treat every service connection as one half of a pair. Terminate the two tunnels of a pair on separate physical or virtual edge devices, and — where the topology allows — bind them to different Prisma Access compute locations. The goal is that the loss of one IPSec terminator, one ISP circuit, or one Prisma location degrades capacity but never severs reachability to a given data centre.
When you advertise the same private prefixes over both connections, use routing metrics (or AS-path prepending on BGP) to make one path preferred and the other a warm standby. Equal-cost paths are attractive for capacity but make troubleshooting asymmetry far harder — decide deliberately.
Mobile user resilience is a DNS and health problem
For mobile users, availability is decided at gateway selection. Prefer GlobalProtect configurations that resolve users to the best gateway dynamically based on latency and health, rather than pinning users to a single gateway by static priority. When a gateway or an entire location degrades, healthy users should be re-homed automatically on the next connection attempt without a manual portal change.
Test the failure, not just the design. Force a gateway out of service in a maintenance window and confirm that clients re-establish on an alternate gateway within your target time, and that split-tunnel and access policies are identical on both. A common gap is a secondary gateway with a stale or narrower policy that only surfaces during a real outage.
Routing symmetry is where scale bites
Most "random" Prisma Access problems at scale are asymmetric routing: traffic leaves through one service connection and tries to return through another, breaking stateful inspection. Keep forward and return paths deterministic. Summarise routes consistently at each data-centre edge, avoid overlapping advertisements between paired connections without clear preference, and document the intended traffic flow per region so operations can spot deviation quickly.
Operational readiness
Instrument before you need it: tunnel and BGP state, per-location user counts, and gateway health should be on a dashboard your NOC watches, not something you query after an incident. Capacity-plan for the failure state — if losing one location must be survivable, the surviving locations have to carry the combined load without breaching latency SLOs.