Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add andycungkrinx91/konoha --skill deploying-palo-alto-prisma-access-zero-trustgit clone --depth 1 https://github.com/andycungkrinx91/konohaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/andycungkrinx91/konoha/deploying-palo-alto-prisma-access-zero-trust)<a href="https://agentmods.dev/skills/andycungkrinx91/konoha/deploying-palo-alto-prisma-access-zero-trust"><img src="https://agentmods.dev/badge/skills/andycungkrinx91/konoha/deploying-palo-alto-prisma-access-zero-trust/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/andycungkrinx91/konoha/deploying-palo-alto-prisma-access-zero-trust"><img src="https://agentmods.dev/badge/skills/andycungkrinx91/konoha/deploying-palo-alto-prisma-access-zero-trust.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.02737 |
| Opus 5.5 | $0.00022 | $0.01095 |
| Sonnet 5.5 | $0.00011 | $0.00547 |
| Haiku 4.5 | $0.00006 | $0.00274 |
Grade A, and why
deploying-palo-alto-prisma-access-zero-trust scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to deploying-palo-alto-prisma-access-zero-trust — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 310 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Deploying Palo Alto Prisma Access Zero Trust
When to Use
- When implementing enterprise-grade SASE with integrated ZTNA, SWG, CASB, and FWaaS
- When replacing both VPN and branch office firewalls with cloud-delivered security
- When needing advanced threat prevention (WildFire, DNS Security) for remote access traffic
- When deploying zero trust for both mobile users and remote network (branch) connections
- When integrating ZTNA with existing Palo Alto NGFW infrastructure via Strata Cloud Manager
Do not use for small organizations (< 200 users) where simpler ZTNA solutions suffice, for environments requiring only web application access without full network security, or when budget constraints preclude enterprise SASE licensing.
Prerequisites
- Prisma Access license (Business Premium or equivalent)
- Strata Cloud Manager (SCM) tenant configured
- GlobalProtect agent for endpoint deployment
- ZTNA Connector VM: 4 vCPU, 8GB RAM, 128GB disk (VMware, AWS, Azure, or GCP)
- Identity provider: Okta, Entra ID, Ping Identity (SAML 2.0)
- Palo Alto Cortex Data Lake for log storage
Workflow
Step 1: Configure Prisma Access Infrastructure in Strata Cloud Manager
Set up the cloud infrastructure for mobile user and remote network connections.
Strata Cloud Manager > Prisma Access > Infrastructure Settings:
Mobile Users Configuration:
- Service Connection: Auto-selected based on user location
- DNS Servers: 10.1.1.10, 10.1.1.11 (corporate DNS)
- IP Pool for Mobile Users: 10.100.0.0/16
- Authentication: SAML with Okta (Primary), Entra ID (Secondary)
- GlobalProtect Portal: portal.company.com
- GlobalProtect Gateway: Auto (nearest Prisma Access location)
Infrastructure Subnet:
- Range: 172.16.0.0/16
- Allocation: /24 per Prisma Access location
Step 2: Deploy ZTNA Connectors for Private Application Access
Install ZTNA Connectors to provide secure access to internal applications.
# Deploy ZTNA Connector on VMware (OVA)
# Download OVA from Strata Cloud Manager > Prisma Access > ZTNA Connectors
# AWS deployment via CloudFormation
aws cloudformation create-stack \
--stack-name prisma-ztna-connector \
--template-url https://prisma-access-connector-templates.s3.amazonaws.com/ztna-connector-aws.yaml \
--parameters \
ParameterKey=VpcId,ParameterValue=vpc-PROD \
ParameterKey=SubnetId,ParameterValue=subnet-PRIVATE \
ParameterKey=InstanceType,ParameterValue=m5.xlarge \
ParameterKey=TenantServiceGroup,ParameterValue=TSG_ID \
ParameterKey=ConnectorName,ParameterValue=dc-east-connector-01
# Verify connector registration
# Strata Cloud Manager > Prisma Access > ZTNA Connectors
# Status should show "Connected" with nearest Prisma Access location
# Deploy second connector for HA
# ZTNA Connector auto-discovers nearest Prisma Access location
# IPSec tunnel uses: ecp384/aes256/sha512 for IKE and ESP
# Bandwidth: up to 2 Gbps per connector
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 310 lines · 55 tokens per session scan A 0ff702b1177d
deploying-palo-alto-prisma-access-zero-trust is a skill published in the GitHub repository andycungkrinx91/konoha (12 stars, last pushed today), licensed MIT. It adds 55 tokens to every session and 2,737 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 100% identical to deploying-palo-alto-prisma-access-zero-trust, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
deploying-palo-alto-prisma-access-zero-trust
Deploying Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager for unified security management.
deploying-palo-alto-prisma-access-zero-trust
Deploying Palo Alto Networks Prisma Access for SASE-based zero trust network access using GlobalProtect agents, ZTNA Connectors, security policy enforcement, and integration with Strata Cloud Manager for unified security management.
configuring-zscaler-private-access-for-ztna
Configuring Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application segments, configuring access policies based on user identity and device posture, and integrating with IdPs.
configuring-zscaler-private-access-for-ztna
Configures Zscaler Private Access (ZPA) to replace traditional VPN with zero trust network access by deploying App Connectors, defining application segments, configuring identity- and device-posture-based access policies, and integrating with IdPs. Use when replacing VPN concentrators with ZTNA or providing remote…
implementing-zero-trust-network-access
Implementing Zero Trust Network Access (ZTNA) in cloud environments by configuring identity-aware proxies, micro-segmentation, continuous verification with conditional access policies, and replacing traditional VPN-based access with BeyondCorp-style architectures across AWS, Azure, and GCP.
configuring-aws-verified-access-for-ztna
Configure AWS Verified Access to provide VPN-less zero trust network access to internal applications using identity and device posture verification with Cedar policy language.