A customer wants to deploy Prisma SD-WAN ION devices at small home offices that use...

Comprehensive and Detailed Explanation

Prisma SD-WAN utilizesSTUN (Session Traversal Utilities for NAT)to facilitateNAT Traversalfor its Secure Fabric overlay.

Discovery:When an ION device connects to the internet behind a NAT router, it reaches out to the Prisma SD-WAN Controller. The controller acts as a STUN server, identifying thepublicIP address andportthat the ION's traffic is originating from.

Symmetric NAT Challenge:In Symmetric NAT, the mapping changes for every destination. However, the Prisma SD-WAN architecture is designed to handle this by having the controller coordinate the connection attempt.

Hole Punching:The controller shares the discovered public mapping information between two peer ION devices. They then simultaneously initiate traffic to each other's public IP/Port (a technique called "UDP Hole Punching"). This tricks the intermediate NAT devices into allowing the inbound traffic, establishing a direct P2P IPSec tunnel without requiring manual port forwarding or static IPs at the edge.