Palo Alto Prisma Virtual ION Cluster - Specifications
Palo Alto Prisma Virtual ION Cluster
This blueprint provisions a Palo Alto SDWAN Gateway based on the Prisma Virtual ION image in cluster deployment mode. The cluster topology provisions two virtual devices. The specification does not describe internal cluster redundancy mechanics; the platform will create two devices when the cluster option is selected.
Flavors
The available sizes for the Palo Alto Prisma Virtual ION Cluster are shown below. Choose the flavor that matches your expected capacity needs.
| Standard | DPDK | |
|---|---|---|
| Small | 2 vCPU 8 GB Mem 64 GB Disk | - |
| Large | 8 vCPU 32 GB Mem 64 GB Disk | 8 vCPU 32 GB Mem 64 GB Disk |
In dual or cluster topologies the selected flavor is applied to the virtual devices that make up the deployment.
Interfaces
The diagram shows the two virtual devices in the cluster and the relationships between the Internet interfaces and platform-provided public IP outputs, plus the MPLS-VPN interface with supported VLAN sub-interfaces (101–108).
#1 - Internet Interface - management
This interface is informational in the portal and is used to display the platform-allocated public IPv4 address for management per virtual device.
- What you must provide: none for the public IP; the address is allocated by the platform and displayed after provisioning.
- Where to view it: the platform provisioning results and service outputs.
#2 - Internet Interface - access
This interface is informational in the portal and is used to display the platform-allocated public IPv4 address for access per virtual device.
- What you must provide: none for the public IP; the address is allocated by the platform and displayed after provisioning.
- Where to view it: the platform provisioning results and service outputs.
#3 - MPLS-VPN interface
The MPLS-VPN interface supports VLAN sub-interfaces 101 through 108. Each VLAN sub-interface can host a list of VPN entries and optional BGP settings.
Common settings for VLAN sub-interfaces:
- VPN list: one or more VPN entries (minimum 1, maximum 99). Each entry identifies the VPN to attach to the VLAN sub-interface.
- What you must provide: the VPN Name for each entry. The portal may offer selectable VPNs or a free-text field respecting the allowed pattern.
- Constraints: the VPN Name must match alphanumeric characters, hyphen or underscore.
- VPN role: optional selection with possible values any-to-any, client, server.
- Enable BGP: optional toggle (default: disabled). If you enable BGP, additional BGP fields become relevant.
- AS prepend: optional integer used when BGP is enabled. Allowed values are 1 to 6.
Group these settings once in the portal when configuring each VLAN sub-interface; the same structure applies to VLANs 101–108.
Routing and BGP parameters
BGP configuration options are available per VLAN sub-interface as described above. In the portal you can enable BGP for a VLAN sub-interface and set the AS prepend value (integer 1..6) when required. If BGP is not enabled, no BGP-specific configuration is applied through this setting. The specification does not describe the detailed route exchange behavior.
Virtual device parameters
The blueprint provisions two virtual devices. VM-level parameters that appear during provisioning include:
- VM AS number (per virtual device): an Autonomous System number accepted as 2- or 4-byte AS (integer range 1..4294967295). Provide this value only if you intend to enable BGP for the device. According to the specification, the VM AS number is not updatable after provisioning.
If both virtual devices share the same image, flavor and userdata logic, the provisioning form requests them once per device as required by the portal.
Service specific parameters
Service specific parameters are service-level values requested during provisioning and are not VM interface addresses or platform outputs. For this VNF they are credentials required by the Prisma SDWAN orchestration step as specified by the blueprint:
-
Prisma SDWAN key (VM1 / VM2)
- What this is: a device connection key used by the Prisma SDWAN orchestrator for device registration or orchestration during provisioning.
- Why the platform needs it: the provisioning process requires this credential to complete the vendor orchestration step as defined in the blueprint. The specification does not describe the orchestrator internals.
- Customer action: enter the Prisma SDWAN key for each virtual device in the provisioning form. This field is mandatory and treated as sensitive; it is hidden in the portal and not editable after creation.
-
Prisma SDWAN secret (VM1 / VM2)
- What this is: the secret paired with the Prisma SDWAN key.
- Why the platform needs it: used during the orchestration step for device authentication as specified by the blueprint. Exact orchestration behavior is not described.
- Customer action: enter the Prisma SDWAN secret for each virtual device in the provisioning form. This field is mandatory, sensitive, and not editable after creation.
These service values are distinct from VM AS numbers and from the platform-generated public IP outputs.
Platform-generated outputs
The platform allocates public IPv4 addresses for the Internet interfaces and displays them after provisioning. These public IP addresses are platform outputs and are not customer-provided interface parameters. Specifically:
- Public IP address for #1 - Internet Interface - management (one per virtual device).
- Public IP address for #2 - Internet Interface - access (one per virtual device).
Software device versions
Below are the software image identifiers available for this VNF on the platform.
- 6.2.1-b3