For how many hours are Prisma SD-WAN VPN shared secrets valid?

Prisma SD-WAN automates the security of the Secure Fabric VPN tunnels established between ION devices. The controller is responsible for the lifecycle management of the IPsec shared secrets used for authentication and tunnel establishment. To enhance security and prevent key compromise, the controller automatically generates, distributes, and rotates these shared secrets for all VPN tunnels every 24 hours. This process ensures that the keys are regularly refreshed without requiring manual administrator intervention, maintaining a robust security posture across the SD-WAN fabric.

A. 1 hour is an incorrect duration; the documented rotation interval is significantly longer to balance security with operational overhead.

B. 8 hours is not the standard rotation period for Prisma SD-WAN VPN shared secrets as specified in the official documentation.

D. 72 hours is an incorrect value; the shared secrets are rotated more frequently to adhere to security best practices.

1. Palo Alto Networks. (2023). Prisma SD-WAN Administrator’s Guide 6.3. "Secure Fabric". In the section describing VPN security, it states: "The controller automatically generates, distributes, and rotates shared secrets for VPN tunnels between ION devices every 24 hours."