When configuring SASE connectivity with easy onboarding at a branch, which two options must be...

Prisma SD-WAN simplifies the integration with Prisma Access through a feature known as "CloudBlades," specifically the Prisma Access for Networks CloudBlade. The "easy onboarding" workflow is designed to automate the complex task of establishing secure tunnels between Branch ION devices and the SASE security processing nodes (SPNs).

When an administrator initiates this process, the system abstracts the manual configuration of IKE and IPSec parameters. Instead of manually defining an IPSec Crypto Profile or an IKE Profile (which are automatically handled by the CloudBlade orchestration), the user must specify where the traffic is going and which physical resources will handle the connection. The Prisma Access Primary Location (Option B) is a mandatory selection because it determines the geographical region and specific compute instance within the Prisma Access cloud that will serve as the primary security gateway for that branch.

Furthermore, the IPSec Termination Node (Option D) must be selected to define the specific endpoint within the Prisma Access infrastructure where the ION device's tunnels will terminate. This selection ensures that the Controller can properly orchestrate the site-to-site VPN tunnels, ensuring that the branch traffic is correctly routed to the SASE fabric for security inspection. By selecting these two options, the CloudBlade can automatically negotiate the rest of the tunnel parameters, significantly reducing the potential for human error and accelerating the deployment of a Secure Access Service Edge (SASE) architecture across multiple branch locations.