Carry access policy beyond the plant boundary.
Manufacturing & Industrial
SASE and identity integration, with technical support for Prisma Access Browser.
The constraint
Employees, shared devices and external users have different access needs. The design had to account for identity, endpoint context and application permissions, alongside dependencies on other workplace and cloud projects.
Our work
The client’s access requirements extend across facilities, remote users and applications. Quokka’s network and identity work connected with Prisma Access, with further design and technical support for browser-based access.
What changed
Connect identity and network policy
Bring the existing identity and device controls into the secure access design, with Prisma Access and GlobalProtect supporting connectivity.
Work through the browser use cases
Design how shared kiosks, unmanaged devices and external users could reach permitted applications, with the required identity and policy integrations.
Support the wider delivery
Provide technical guidance during Palo Alto Networks’ initial Prisma Access Browser deployment, and identify the dependencies on kiosk and cloud workload projects.
The result
The client’s operating environment uses Prisma Access, GlobalProtect and Prisma Browser. Quokka’s contribution spans the network and identity foundation, access design and specialist assistance with browser integration.
Quokka provided design, integration guidance and deployment assistance alongside the technology vendor.
The engineering decisions.
The engineering follows the user, device and application: a shared kiosk, a supplier session and a personal phone need different access paths.
Authenticate the person using a shared kiosk
The browser design combines an Intune-managed Windows kiosk with individual sign-in to Prisma Access Browser through Cloud Identity Engine and Entra ID. The shared operating-system session and the person using an application are separate concerns. The design also accounts for user-linked printing and the browser extension needed to support that workflow.
Limit supplier access to the required applications
The supplier use case uses guest identity and role groups to select the applications a person can reach. It includes controlled access to connection-management services for remote administration, with the permitted application list adjusted to the support task. This sits alongside the broader Prisma Access environment and its existing network controls.
Choose the private-application path for the device
The design distinguishes browser access through an explicit proxy, access with a GlobalProtect tunnel already established, and access from within the corporate network. Internal-host detection helps select the appropriate path. Cloud Identity Engine authentication and directory synchronisation are prerequisites for onboarding users and applying group-based policy.
Sequence browser deployment with the wider changes
Kiosk configuration, application location and identity mappings each affect whether the intended user flow works. Quokka provided design and deployment assistance alongside Palo Alto Networks, which delivered the initial browser deployment. Further kiosk, supplier and unmanaged-device use cases depend on their own integration and validation work.
What needs to work better?
Talk to us about the environment, the constraint and the change.