A large retailer has deployed all of its stores with the same IP address subnet. An engineer is onboarding these stores as Remote Networks in Prisma Access. While onboarding each store, the engineer selects the “Overlapping Subnets” checkbox. Which Remote Network flow is supported after onboarding in this scenario?

The "Overlapping Subnets" feature in Prisma Access is specifically designed to address the challenge of connecting multiple remote sites (like retail stores) that use the same private IP address ranges to central corporate resources. By enabling this feature, Prisma Access applies Source Network Address Translation (SNAT) to traffic from these remote networks. It translates the original, overlapping source IP into a unique IP from a predefined pool before forwarding it to the destination. This process ensures that corporate data centers or private applications receive traffic from unique, routable source IPs, enabling communication. While internet access also works, the primary problem this feature solves is enabling access to private applications.

B. To the internet: While internet access is a supported flow, the core problem solved by the "Overlapping Subnets" feature is enabling access to private corporate resources, not general internet access.
C. To remote network: This flow is explicitly unsupported. Prisma Access cannot route traffic between two remote networks that share the same IP subnet, as the destination would be ambiguous.
D. To mobile users: Communication initiated from a remote network to a mobile user is not a standard supported flow, and routing from a mobile user to a specific overlapping site is not possible.

1. Palo Alto Networks Prisma Access Administrator’s Guide: In the section "Onboard Remote Networks with Overlapping Subnets," the documentation states, "When you have remote networks that have the same (overlapping) IP addresses, you can onboard them to Prisma Access. Prisma Access uses a source NAT (SNAT) policy to translate the source IP addresses from these remote networks into a unique, non-overlapping IP address from a NAT pool that you define. This allows the remote network locations to communicate with your headquarters or data centers and to access the internet. However, with this configuration, remote network locations with overlapping subnets cannot communicate with each other." This text directly supports that flows to private applications (data centers) and the internet are allowed, while remote-network-to-remote-network flows are not. The primary purpose described is enabling communication to headquarters or data centers.