In a Prisma SD-WAN deployment, what is the defining characteristic of a "Standard VPN" compared to a "Secure Fabric Link"?

In Prisma SD-WAN, the "Secure Fabric" refers to the network of automatically established, full-mesh or hub-and-spoke IPSec tunnels between ION devices. This process is orchestrated by the controller and requires minimal manual intervention. Conversely, a "Standard VPN" (also known as a Third-Party VPN) is a manually configured, standards-based IPSec tunnel. It is used to connect a Prisma SD-WAN ION device to a non-ION endpoint, such as a third-party firewall, a legacy branch router, or a public cloud VPN gateway. The key distinction is the automated, ION-to-ION nature of the Secure Fabric versus the manual, ION-to-non-ION configuration of a Standard VPN.

A. Both Secure Fabric links and Standard VPNs utilize the IPSec protocol suite for secure tunneling, not GRE or VXLAN as their primary encapsulation.

B. This statement is reversed. Secure Fabric Links are automatically built between ION devices, whereas Standard VPNs require manual configuration.

D. Both Secure Fabric Links and Standard VPNs support dynamic routing protocols, including BGP. The Secure Fabric heavily relies on BGP for route exchange.

1. Palo Alto Networks Prisma SD-WAN Administrator's Guide: In the section "Third-Party VPNs," the guide details the manual process for establishing connections to non-Prisma SD-WAN peers. It states, "You can configure Prisma SD-WAN to connect to third-party, non-Prisma SD-WAN peers over an IPsec VPN tunnel." This aligns with the definition of a Standard VPN.

2. Palo Alto Networks Prisma SD-WAN Administrator's Guide: The "Secure Fabric" or "Auto-Tunnels" concept is described as the core of the SD-WAN overlay. The documentation explains, "Prisma SD-WAN creates a secure fabric of IPsec tunnels among the ION devices in your network... The controller automatically orchestrates the setup of VPN tunnels between the ION devices." This confirms the automated, ION-to-ION nature of Secure Fabric Links.

3. Palo Alto Networks Prisma SD-WAN Design and Sizing Guide: This guide differentiates between the automated overlay fabric for inter-site communication (Secure Fabric) and the manually configured tunnels required for integration with external networks or non-ION devices (Standard/Third-Party VPNs), reinforcing the distinction in configuration and endpoint type. (See section on Network Integration and VPN Topologies).