| name | prisma-sdwan |
| description | Comprehensive guide for designing, deploying, operating, and troubleshooting Palo Alto Networks Prisma SD-WAN. Covers architecture, configuration, policies, routing, and operations. |
| license | Proprietary |
| metadata | {"version":"1.0"} |
Prisma SD-WAN Skill
Overview
This skill provides comprehensive guidance for designing, deploying, operating, and troubleshooting Palo Alto Networks Prisma SD-WAN environments. Prisma SD-WAN is a cloud-delivered, application-defined SD-WAN solution that forms a key component of the SASE (Secure Access Service Edge) framework.
Core Architecture
Components
Cloud Controller (SaaS)
- Single source of truth for policy configuration and network topology
- Centralized management via cloud-delivered portal (Strata Cloud Manager)
- Multi-tenant capable
- Zero-touch provisioning (ZTP) orchestration
- API-driven automation platform
ION Devices (Data Plane)
- Physical appliances: ION 1000, 1200, 2000, 3000, 3200, 5200, 7000, 9000, 9200 series
- Virtual appliances (vION): Available for AWS, Azure, GCP, Alibaba Cloud, KVM, VMware, OCI
- Hardware models with cellular: ION 1200-C, 1200-S-C (4G/5G)
- Temperature-hardened variants: ION 3200H
ION Fabric
- Overlay mesh of encrypted IPSec tunnels (AES-256)
- Multiple overlay types: Direct, Prisma SD-WAN VPN, Standard VPN
- Automatic tunnel establishment between sites
- Dynamic path selection based on application requirements
Management Platforms
- Strata Cloud Manager: Primary unified management interface
- Strata Multitenant Cloud Manager: MSP/multi-tenant management
- On-premises controller option available
Deployment Modes
Analytics Mode
- ION device monitors traffic in-path
- Provides visibility and analytics
- No policy enforcement or path selection
- Used for baseline assessment
Control Mode
- Full SD-WAN functionality enabled
- Dynamic path selection
- Policy enforcement (QoS, Security, Path)
- Application steering and optimization
Disabled Mode
- ION device bypasses all traffic
- Used for maintenance or troubleshooting
Design Principles
Site Architecture Models
Branch Deployments
Layer 2-Only Model
- ION deployed in-line between switch and router
- Internet links terminate on ION
- Private WAN terminates on existing router
- Uses bypass pairs for private WAN
- Minimal routing configuration
Layer 2/Layer 3 Model
- ION in-line with L3 WAN interface capability
- WAN interfaces configured for L3 routing
- Supports BGP/OSPF peering with existing routers
- Requires "L3 Direct Private WAN Forwarding" enabled
Router Replacement Model
- ION terminates both private WAN and internet links
- ION participates in dynamic routing with edge router
- Advertises branch prefixes, learns core prefixes
- Maximum consolidation of branch hardware
Data Center Deployments
BGP-Based DC Deployment (Off-Path)
- ION connects to DC core router (off-path)
- Attracts traffic via more-specific BGP routes
- Only attracts Prisma SD-WAN branch traffic
- Supports core, edge, and classic BGP peers
- Requires BGP for HA scenarios
OSPF-Based DC Deployment (In-Path)
- ION placed in-path between private WAN and core router
- Supported from device version 6.4.1+
- OSPF adjacencies with LAN/core devices
- Route redistribution between BGP and OSPF
DC Peer Types
- Core Peer: DC core/LAN router (auto route-map generation)
- Edge Peer: WAN edge/MPLS PE router (auto route-map generation)
- Classic Peer: Manual route-map configuration required
High Availability Design
Branch HA
- Dual ION devices at branch
- Active-active or active-backup
- Automatic failover
- Shared configuration via controller
Data Center HA
- Requires BGP on core/LAN side
- Host tracking for tunnel health monitoring
- Automatic tunnel failover to standby DC ION
- Integration with Azure Route Server (ARS) or AWS Transit Gateway
Virtual ION HA
- Deploy vION pairs in different availability zones
- Use CloudBlades for automated deployment (AWS Transit Gateway, Azure vWAN)
- Marketplace solution templates available
Network Context and Segmentation
Network Contexts
- Segment traffic for different policy treatment
- Highest precedence in policy evaluation
- Examples: Guest, Corporate, Voice, IoT
- Attached to LAN networks/interfaces
- Enables micro-segmentation without VRFs
Security Zones
- Define enforcement boundaries for ZBFW
- Map to physical/logical interfaces
- Types: LAN, WAN, VPN zones
- Support VLAN, L3 VPN, L2 VPN circuits
- Each zone independently secured
Configuration Workflow
1. Initial Setup
Prerequisites
- Valid Prisma SD-WAN license (bandwidth-based or DC unlimited)
- Network design document with site topology
- IP addressing plan (management, WAN, LAN)
- Application inventory and requirements
Activation Steps
1. Access Strata Cloud Manager
2. Navigate to Activation & Onboarding
3. Claim ION devices using serial numbers
4. Assign appropriate software subscription
5. Configure basic site information
Zero-Touch Provisioning (ZTP)
- ION devices auto-register to controller on first boot
- Controller port connects to internet
- Device downloads configuration automatically
- Minimal on-site configuration required
2. Site Configuration
Create Site
Configuration → Prisma SD-WAN → Sites → Add Site
- Site Name, Description, Tags
- Address and Location
- Site Type: Branch or Data Center
- Admin State: Active, Monitor, or Disabled
Configure Device Basic Info
Configuration → Prisma SD-WAN → ION Devices → Claimed → Configure
Basic Info Tab:
- Device Name
- Deployment Mode: Analytics, Control, Disabled
- Enable L3 Direct Private WAN Forwarding (if using L3 private WAN)
- Enable L3 LAN Forwarding (for dynamic LAN routing)
Note: L3 LAN Forwarding requires no Private L2 bypass pairs configured
3. Interface and Circuit Configuration
Circuit Categories
- Define WAN circuit types: MPLS, Internet, Broadband, LTE/5G
- Used in path policies for circuit selection
- Configured globally, applied to circuits
Configure Circuits
Configuration → Prisma SD-WAN → Sites → Site → Circuits
- Circuit Name
- Category (MPLS, Internet, etc.)
- Bandwidth (Download/Upload)
- Circuit Type: Public, Private, or Private WAN
- Enable Device-Initiated Connections (for NAT traversal)
Interface Configuration
Configuration → Prisma SD-WAN → ION Devices → Interfaces
- Assign interface to circuit
- Configure IP addressing (Static, DHCP, PPPoE)
- VLAN tagging if required
- MTU configuration
- Enable/disable interfaces as needed
Bypass Pairs (Layer 2)
- WAN and LAN interfaces paired for failover
- Traffic bypasses ION if device fails
- Configured for private WAN underlay
- Cannot be used with L3 LAN Forwarding
LAG/LACP Support
- Available on ION 3200, 5200, 9200 (branch sites - 6.5+)
- Available on DC sites (6.5.2+)
- Standard 802.3ad link aggregation
- Enhanced throughput and redundancy
4. Routing Configuration
Static Routing
Branch Static Routes
Configuration → ION Devices → Device → Routing → Static Routes
- Destination Network
- Next Hop (IP or Interface)
- Scope: Local or Global
- Local: Not advertised to fabric
- Global: Advertised to other sites
Use Cases
- LAN subnets behind L3 switches
- Specific destinations via private WAN
- Standard VPN endpoint routes
BGP Configuration
BGP Global Configuration
Configuration → ION Devices → Device → Routing → BGP Global
- Local AS Number (1-4294967295, 4-byte ASN support)
- Router ID (IPv4 address, must be same within VRF)
- Timers: Keepalive (3-60s), Hold (9-180s)
- Maximum Paths for ECMP
Create BGP Peer
Configuration → ION Devices → Device → Routing → Create Peer
Peer Information:
- Name, Description, Tags
- VRF: Global or custom VRF
- Peer IP Address (IPv4/IPv6)
- Remote AS Number
- Peer Type (DC only): Core, Edge, Classic
- Router ID
- Update Source IP (multi-hop scenarios)
Route Maps:
- Route Map In: Filter incoming routes
- Route Map Out: Filter outgoing routes
- Advertise Default to Peer (optional)
Override Global Configs (optional):
- Keepalive Time
- Hold Time
- Maximum Paths
- Authentication (MD5 password)
BGP Peer Types (Data Center)
- Core Peer: Peers with DC core/LAN router; auto route-map generated; advertises branch prefixes
- Edge Peer: Peers with WAN edge/PE router; auto route-map generated; receives prefixes only
- Classic Peer: Manual configuration; use for complex scenarios
Branch BGP
- Supports classic peers only
- Peer with LAN devices, private WAN routers
- Routes exchanged with WAN and LAN peers
- Learned routes sent to controller API
Route Advertisement Controls
- Distribute to Fabric: Selective branch advertisement
- Host Tracking: Monitor reachability beyond peer
- Tunnel deactivation on tracking failure
OSPF Configuration
OSPF Support (Available 6.4.1+)
- Branch: LAN-side OSPF neighbors
- Data Center: LAN and WAN-side OSPF
- Full RFC compliance
- Route redistribution with BGP
Prerequisites
Enable both:
- L3 Direct Private WAN Forwarding
- L3 LAN Forwarding
Remove all Private L2 bypass pairs
Configure OSPF
Configuration → ION Devices → Device → Routing → OSPF
OSPF Infra Settings:
- Edit Route Maps and Prefix Lists
Create OSPF Configuration:
General Tab:
- Name
- VRF (Global or custom)
- Router ID (optional, IPv4 address)
- LAN Prefix Advertisement (Default: 0.0.0.0/0 only)
- LAN Advertisement Route Map (optional)
- Redistribute BGP (optional)
- Scope: Local or Global
Area & Interfaces Tab:
- Area ID (x.x.x.x format)
- Area Type: Standard, Stub, NSSA, Totally Stub, Totally NSSA
- Add Interfaces to area
- Interface timers:
* Hello Interval (1-65535s, default 10)
* Dead Interval (1-65535s, default 40)
* Retransmit Interval (1-65535s, default 5)
* Transit Delay (1-65535s, default 1)
- Authentication: None, Plain Text, MD5
- Network Type: Broadcast, Point-to-Point, NBMA
Route Redistribution
- BGP to OSPF: Redistribute BGP prefixes into OSPF
- OSPF to BGP: Redistribute OSPF routes into BGP
- Connected/Static to both protocols
- Configure via route maps for filtering
5. Policy Configuration
Policy Stack Architecture
Stack Types
- Simple Stacks: Single policy set, easier management
- Advanced Stacks: Multiple policy sets (up to 4 + default), stacked left-to-right priority
Policy Categories
- Path Policy: Traffic engineering, path selection
- QoS Policy: Application prioritization, DSCP marking
- Security Policy: Zone-based firewall rules
- NAT Policy: Address translation rules
- Performance Policy: SLA enforcement, FEC
Path Policy Configuration
Create Path Policy Set
Configuration → Prisma SD-WAN → Policies → Path → Path Stacks → Advanced
Add Path Policy Set:
- Default Rule Policy Set (includes Default + Enterprise Default)
- Create from Template
- Clone from existing Policy Set
- Blank policy set
Set Attributes:
- Name, Description, Tags
Add Path Policy Rule
Select Path Set → Add Rule
Info Tab:
- Name, Order (default 1024)
- Description, Tags
- Enable/Disable rule
Prefixes Tab:
- Source Prefix Filter (optional)
- Destination Prefix Filter (optional)
- Network Context (optional)
Apps Tab:
- Select Applications (up to 256 per rule)
- Filter: For sites 6.0.1+, below 6.0.1, any site
- Application types: System (PANW), System (CGX), Custom
Paths Tab:
Path Selection Method:
1. SLA Compliant Path:
- Define SLA metrics: Latency, Loss, Jitter, MOS
- Probe metrics: ICMP, DNS, HTTP/S
- App metrics: TCP Init Failure, RTT, TRT (UDP)
- Active Paths (required): SLA-compliant paths
- Backup Paths (optional): Used if active paths non-compliant
- L3 Failure Paths (optional): Emergency route for L3 failures
2. Best Path Selection:
- Selects optimal path dynamically
- No SLA constraints
Per Path Configuration:
- Overlay: Direct, Prisma SD-WAN VPN, Standard VPN
- Circuit Category: Select appropriate category
- Cannot repeat overlay + circuit category combination
Path Policy Precedence (Longest Match, Ascending Order)
- Network Context (highest)
- Source Prefix Filter
- Application
- Destination Prefix Filter (lowest)
Path Selection Logic
- Apply path policy rules (longest match)
- Filter by performance policy constraints
- Filter by synthetic health probes
- Filter by link quality monitoring (LQM)
- Apply bandwidth steering
- Select best available path
QoS Policy Configuration
Create QoS Policy Set
Configuration → Prisma SD-WAN → Policies → QoS → QoS Stacks → Advanced
Add QoS Policy Set:
- Default Rule Policy Set
- Create from Template
- Clone from Policy Set
- Blank policy set
Add QoS Policy Rule
Select QoS Set → Add Rule
Info Tab:
- Name, Order (default 1024)
- Description, Tags
Prefixes Tab:
- Network Context (highest precedence)
- Source Prefix Filter
- Destination Prefix Filter
Apps Tab:
- Select Applications (up to 256 per rule)
Priority Tab:
- Priority Class: Determines queue assignment
* Real-Time (highest)
* Critical
* Important
* Default
* Bulk (lowest)
- Circuit Capacity Reference (for bandwidth allocation)
DSCP Tab:
- No Action: Leave DSCP unchanged
- Mark/Remark: Set DSCP value (0-63)
- Applied LAN-to-WAN direction
QoS Policy Precedence (Same as Path)
- Network Context
- Source Prefix Filter
- Application
- Destination Prefix Filter
Circuit Capacity Configuration
Configuration → Prisma SD-WAN → Policies → Circuit Capacities
- Define bandwidth allocation per priority class
- Percentage-based allocation
- Applied to QoS rules
Security Policy Configuration
Zone-Based Firewall (ZBFW)
Create Security Zone
Configuration → Prisma SD-WAN → Policies → Security → Security Zones
Add Security Zone:
- Name, Description, Tags
- Assign to networks/interfaces at site level
Create Security Policy Stack
Configuration → Prisma SD-WAN → Policies → Security → Security Stacks
Add Security Stack:
- Name, Description, Tags
- Select security policy sets (up to 4 + default)
Add Security Policy Set
Add Security Policy Set:
- Default Rule Policy Set (includes 3 default rules)
- Clone from existing set
- Blank policy set
Add Security Policy Rule
Select Security Set → Add Rule
Info Tab:
- Name, Order
- Description, Tags
Zones Tab:
- Source Zone(s)
- Destination Zone(s)
Prefixes Tab:
- Source Prefix Filter (optional)
- Destination Prefix Filter (optional)
Apps Tab:
- Select Applications
Ports Tab (optional):
- Source Ports
- Destination Ports
- Protocol
Users/Groups Tab (optional):
- User ID filtering
- Group ID filtering
Action Tab:
- Allow: Permit traffic
- Deny: Drop silently (no ICMP/RST)
- Reject: Drop with ICMP unreachable or TCP RST
Logging Tab:
- Enable/disable logging
- Syslog profile selection
Default Security Rules
- Default Rule: Applies to internet-destined traffic
- Enterprise Default Rule: Applies to RFC1918 traffic
- Deny All: Explicit deny-all rule
Security Features
- Stateful firewall inspection
- Application-aware filtering
- Zone-based enforcement
- Supports User-ID integration
- Centralized policy management
Performance Policy Configuration
Forward Error Correction (FEC)
Configuration → Prisma SD-WAN → Policies → Performance
Create Performance Policy:
- Select Applications
- SLA Thresholds: Latency, Loss, Jitter
- Action: Enable FEC + Packet Duplication
- Apply when SLA violation detected
Bandwidth Steering
- Automatic path selection based on available bandwidth
- Load distribution across multiple paths
- Dynamic adaptation to congestion
NAT Policy Configuration
Configuration → Prisma SD-WAN → Policies → NAT
Add NAT Rule:
- Source/Destination prefixes
- NAT type: Source NAT, Destination NAT
- NAT pool or interface-based NAT
- Port Address Translation (PAT)
Policy Binding
Bind to Sites
Configuration → Prisma SD-WAN → Policies → Bind to Sites
- Select sites (single or multiple)
- Assign Path Stack
- Assign QoS Stack
- Assign Security Stack
- Assign NAT Stack (if applicable)
- Only one stack of each type per site
6. Application Definition
System Applications
- PANW-defined applications (5000+ signatures)
- Automatically updated from cloud
- Layer 7 DPI-based identification
- Includes SaaS, UC, video, enterprise apps
Custom Applications
Configuration → Prisma SD-WAN → Policies → Custom Applications
Add Custom Application:
- Name, Description, Tags
- Category
- Traffic Type
- Match Criteria:
* IP Prefix
* IP Protocol
* L4 Ports (TCP/UDP)
* DSCP values
- Bidirectional matching option
System Application Overrides
- Modify existing system app definitions
- Add custom match criteria
- Change application category
- Use when system app doesn't match traffic pattern
7. CloudBlades Integration
CloudBlade Platform
- API-based integration framework
- No firmware dependency
- Automated workflow generation
- 20+ pre-built integrations
Common CloudBlades
Prisma Access Integration
Configuration → Prisma SD-WAN → CloudBlades → Prisma Access
Requirements:
- Prisma Access subscription
- Prisma SD-WAN 5.2.1+
- IPSec profile configured
Configuration:
- Select Prisma Access cloud
- Service Connection or Manual Setup
- Auto-tunnel creation to nearest Prisma Access PoP
- Tag-based automation (AUTO-prisma-access)
AWS Transit Gateway CloudBlade
Configuration → Prisma SD-WAN → CloudBlades → AWS TGW
Features:
- Automated vION HA deployment
- Auto-connectivity to Transit Gateway
- Multi-region support
- BGP session automation
Azure Virtual WAN CloudBlade
Configuration → Prisma SD-WAN → CloudBlades → Azure vWAN
Features:
- Auto-configuration of secure tunnels
- Integration with Azure backbone
- Direct cloud access optimization
- Simplified vWAN hub connectivity
Zscaler Integration CloudBlade
Configuration → Prisma SD-WAN → CloudBlades → Zscaler
Support:
- IPSec tunnels (AUTO-zscaler tag)
- GRE tunnels (AUTO-zscaler-GRE tag - v2.0.0+)
- Automatic tunnel to Zscaler nodes
- Tag-based site enrollment
Configuration:
- Zscaler cloud selection
- Partner admin credentials
- API key configuration
- IPSec profile name
Other CloudBlades
- Google Cloud Platform
- Checkpoint
- Netskope
- ServiceNow
- Splunk
- Zoom Phone Optimization
- Megaport Virtual Edge
8. Monitoring and Analytics
Dashboard Views
Prisma SD-WAN Summary Dashboard
Navigation: Dashboard → Prisma SD-WAN Summary
- ION device connectivity status
- Link quality metrics (latency, loss, jitter, MOS)
- Top sites by alarms
- Application utilization (top 10 by bandwidth)
- Active links table
- Secure fabric tunnel status
Site Summary Dashboard
Navigation: Dashboard → Sites → Select Site
- Site health score
- Active/inactive circuits
- Application performance metrics
- Path selection statistics
- Security events
- Device status
Predictive Analytics Dashboard
Navigation: Dashboard → Predictive Analytics
- ML-based anomaly detection
- Proactive issue identification
- Site health trends
- Application health scoring
- Capacity planning insights
Application Dashboard
Navigation: Dashboard → Applications
- Application identification statistics
- Per-app performance metrics
- Transaction success/failure rates
- Top applications by bandwidth, sessions
- App-to-path mapping
Link Quality Dashboard
Navigation: Dashboard → Link Quality
- Per-link performance metrics
- Latency, loss, jitter, MOS trends
- Circuit health scoring
- Comparative link analysis
- Historical performance data
Flow Browser
Navigation: Analyze → Flows
- Real-time and historical flow data
- Filter by: Site, App, User, Interface, Zone
- Per-flow metrics: Bandwidth, packets, latency, loss
- Export to CSV for offline analysis
- Drill-down into specific sessions
9. Incidents and Alerts
Alert Categories
- Critical: Network down, requires immediate action
- Warning: Network impacted, needs attention
- Informational: Network degradation, attention soon
Incident Types
- Network: Circuit down, path failures, routing issues
- Device: Hardware failure, software issues, registration problems
- Cellular: Signal quality, carrier issues, SIM problems
- Branch HA: Failover events, sync issues
- Authentication: User-ID failures, certificate issues
Incident Management
Navigation: Incidents & Alerts → Troubleshooting
Actions:
- Acknowledge: Mark awareness, no immediate action
- Unacknowledge: Return to active incident queue
- Filter: By severity, priority, category, site, time
- Troubleshoot: Follow guided troubleshooting steps
- Go to Support: Create support ticket
Filters Available:
- Admin State: Active, Monitor, Disabled
- Severity: Critical, Warning, Informational
- Priority: P1 (highest) to P4 (lowest)
- Category: Network, Device, Cellular, Authentication
- Code: Specific event codes
- Time: Chronological sorting
- Correlation ID: Related incidents
Incident Policies
Configuration → Prisma SD-WAN → Policies → Incident Policies
Create Custom Thresholds:
- Latency thresholds
- Loss percentage thresholds
- Jitter thresholds
- Bandwidth utilization alerts
- Device CPU/memory thresholds
- Temperature alerts
- Custom notification rules
SNMP Integration
Configuration → Prisma SD-WAN → Configuration → SNMP
Configure SNMP:
- SNMP v2c or v3
- Community strings (v2c)
- Authentication/Privacy (v3)
- Trap destinations
- MIB support for monitoring platforms
Syslog Integration
Configuration → Prisma SD-WAN → Policies → Syslog Profiles
Configure Syslog:
- Syslog server IP/hostname
- Port (default 514)
- Protocol: UDP, TCP, TLS
- Facility codes
- Severity filtering
- Associate with security policies
Operations
Device Lifecycle Management
Device Claiming
1. Unbox ION device
2. Connect controller port to internet
3. Power on device
4. Navigate: Configuration → ION Devices → Unclaimed
5. Claim using serial number or auto-discovery
6. Assign to site
7. Apply configuration template
8. Monitor registration status
Software Upgrade
Configuration → ION Devices → Software Management
Process:
1. Review release notes
2. Schedule maintenance window
3. Select target version
4. Stage software to devices
5. Activate upgrade (per device or bulk)
6. Monitor upgrade progress
7. Verify post-upgrade health
8. Rollback if necessary (automatic on failure)
Best Practices:
- Upgrade controller components first
- Pilot upgrade on test/non-critical sites
- Perform upgrades during maintenance windows
- Maintain previous version for rollback
- Upgrade DC sites before branches
Configuration Backup
Configuration → ION Devices → Configuration Backup
Capabilities:
- Automatic daily backups
- Manual backup on-demand
- Configuration versioning
- Restore to previous configuration
- Export configuration as JSON
- Compare configuration versions
RMA Process (Enhanced in 6.5+)
1. Identify failed device
2. Navigate: Configuration → ION Devices → RMA
3. Select device for replacement
4. Provision replacement device
5. Ship replacement to site
6. Site personnel swap device (ZTP takeover)
7. Old device auto-deregistered
8. Return failed device
Performance Optimization
Path Selection Tuning
- Review path selection statistics
- Adjust SLA thresholds based on actual performance
- Configure synthetic probes for critical apps
- Enable FEC for loss-sensitive applications
- Use backup paths for resilience
QoS Optimization
- Monitor priority queue utilization
- Adjust circuit capacity allocations
- Review DSCP marking effectiveness
- Ensure proper app classification
- Balance real-time vs bulk traffic
Bandwidth Management
- Monitor circuit utilization trends
- Identify top bandwidth consumers
- Apply traffic shaping where needed
- Consider circuit upgrades for consistently saturated links
- Use bandwidth steering for load distribution
Link Quality Monitoring
- Review LQM metrics regularly
- Identify degraded circuits
- Coordinate with ISP on poor performers
- Document baseline performance
- Track trends over time
Security Operations
ZBFW Policy Review
- Audit security rules regularly
- Remove unused rules
- Review denied traffic logs
- Ensure least-privilege access
- Update rules for new applications
User-ID Integration
- Integrate with Active Directory
- Configure User-ID agent (if using)
- Map users to security groups
- Apply user-based policies
- Monitor user activity
Threat Intelligence
- Review security logs
- Identify suspicious patterns
- Coordinate with Prisma Access for advanced threats
- Update security policies based on threats
- Document security incidents
Capacity Planning
Monitoring Key Metrics
- Circuit bandwidth utilization
- ION device CPU/memory usage
- Tunnel capacity
- Application growth trends
- Site expansion requirements
Scaling Considerations
- Device sizing for throughput requirements
- Number of tunnels per device
- BGP route scale (data centers)
- Policy complexity impacts
- Multi-tenant scaling (MSP)
Troubleshooting
CLI Access and Commands
Access Methods
Via Web Interface
1. Navigate: Configuration → ION Devices → Device
2. Select Tools → Device Toolkit
3. Opens CLI session in browser
4. Requires device credentials
Via SSH (If enabled)
ssh username@device-ip
Requires:
- SSH enabled on device
- User credentials configured
- Network reachability
User Roles with CLI Access
- Root
- Network Admin
- Security Admin
- Admin
- Super
- View Only (read-only)
Essential CLI Commands
Clear Commands (Session/statistics clearing)
clear arp
clear bgp [all|ipv4|ipv6]
clear routes
clear flows
Config Commands (Runtime configuration)
config show
config static host <hostname> <ip-address>
config interface <interface-name>
Debug Commands (Active troubleshooting)
debug tcpdump interface <interface-name> [filter]
Example: debug tcpdump interface eth1 host 10.1.1.1
debug ping <destination> [-c count] [-i interval]
debug traceroute <destination>
debug arping interface <interface-name> <target-ip>
debug reboot [now|delayed]
debug interface <interface-name>
debug routing [bgp|ospf|static]
Dump Commands (State information)
dump interface [interface-name]
Example output:
Interface: eth1
Status: up
IP: 10.10.10.1/24
MAC: 00:11:22:33:44:55
dump bgp peers
Shows: Peer state, uptime, prefixes received/advertised
dump routes [ipv4|ipv6]
dump tunnels
Shows: Tunnel state, encryption, metrics
dump servicelink summary
Example output:
-------------- SERVICE LINKS ----------------------------------
Total : 1
TotalUP : 1
TotalDown : 0
---------------------------------------------------------------
dump servicelink status slname=<name>
Shows: IKE/IPSec SA details, encryption, timers
dump servicelink stats slname=<name>
Shows: Rekey counts, tunnel up/down events, byte/packet counters
dump flows [filter options]
Example: dump flows application=Office365
dump system
Shows: CPU, memory, disk, uptime, version
dump ospf neighbors
dump multicast
Inspect Commands (Detailed inspection)
inspect apps
inspect paths
inspect qos
inspect security
inspect circuits
inspect interface <interface-name>
SpeedTest CLI Utility (6.3.6+)
speedtest --interface <interface-name>
Common Issues and Resolution
Connectivity Issues
ION Not Registering to Controller
Symptoms: Device shows offline, not appearing in Claimed Devices
Troubleshooting Steps:
1. Verify physical connectivity:
- Check cable connections
- Verify link lights on controller port
2. Check IP connectivity:
# From CLI:
debug ping 8.8.8.8
debug ping controller.paloaltonetworks.com
3. Verify DNS resolution:
config show | grep dns
4. Check NAT/Firewall:
- Ensure outbound HTTPS (443) allowed
- Check if PAT is working correctly
- Verify no SSL inspection breaking connection
5. Review device logs:
dump system
# Check for certificate or time sync issues
6. Verify controller reachability:
debug traceroute controller.paloaltonetworks.com
7. Check device claim status:
Configuration → ION Devices → Unclaimed
# Manually claim if auto-discovery failed
8. Review time synchronization:
# Ensure NTP is working
dump system | grep time
Resolution:
- Fix network connectivity issues
- Add firewall exceptions for Prisma SD-WAN controller
- Ensure device has valid internet access
- Verify serial number matches claimed device
- Contact support if certificate issues persist
Tunnel Not Establishing
Symptoms: Sites cannot communicate, tunnel shows down
Troubleshooting Steps:
1. Verify tunnel configuration:
dump tunnels
# Check tunnel state, remote endpoint
2. Check circuit status:
dump interface
# Ensure underlying interface is up
3. Verify IP reachability:
debug ping <remote-site-public-ip>
4. Check NAT/Firewall:
- UDP 4500 (IPSec NAT-T)
- UDP 500 (IKE)
- Protocol 50 (ESP)
5. Review IPSec parameters:
dump servicelink status slname=<tunnel-name>
# Check encryption, authentication, DH group mismatch
6. Check MTU issues:
debug ping <remote-ip> -s 1400 -M do
# Test with large packets
7. Review security policies:
# Ensure zones allow VPN traffic
inspect security
8. Check path selection:
inspect paths
# Verify tunnel is being selected
Resolution:
- Fix network path issues (NAT, firewall)
- Adjust MTU if fragmentation detected
- Verify IPSec profile compatibility
- Check for routing issues at remote site
- Review and correct security policies
Poor Application Performance
Symptoms: High latency, packet loss, slow application response
Troubleshooting Steps:
1. Identify affected application:
Navigate: Analyze → Flows
Filter by application
2. Check path selection:
inspect paths
# Verify optimal path being used
3. Review link quality:
Navigation: Dashboard → Link Quality
# Check latency, loss, jitter on active path
4. Verify QoS policy:
Configuration → Policies → QoS
# Ensure app has correct priority
5. Check circuit utilization:
dump interface <interface>
# Look for saturation
6. Review path policy:
# Verify SLA thresholds appropriate
# Check if backup path should be used
7. Enable FEC if lossy path:
Configuration → Policies → Performance
# Add performance policy with FEC
8. Check application identification:
inspect apps
# Verify app correctly identified
9. Analyze flow metrics:
dump flows application=<app-name>
# Review per-flow statistics
Resolution:
- Adjust path policy SLA thresholds
- Enable FEC for loss-sensitive apps
- Increase QoS priority for critical apps
- Add bandwidth or upgrade circuits
- Configure backup paths
- Coordinate with ISP on circuit quality
Routing Issues
BGP Peer Not Establishing
Symptoms: BGP peer state shows Idle, Connect, or Active
Troubleshooting Steps:
1. Verify BGP peer status:
dump bgp peers
2. Check IP reachability:
debug ping <peer-ip>
3. Verify BGP configuration:
Configuration → ION Devices → Routing → Peers
# Check peer IP, AS number, authentication
4. Review firewall rules:
# Ensure TCP 179 allowed
inspect security
5. Check for AS number mismatch:
# Local AS vs Remote AS
6. Verify MD5 authentication:
# If configured, ensure password matches
7. Review router logs:
# Check for error messages in peer logs
8. Check for routing loops:
dump routes
# Verify no conflicting routes
Resolution:
- Correct configuration mismatches
- Fix network connectivity
- Add firewall exceptions
- Verify authentication credentials
- Check for TTL/hop-limit issues (eBGP)
Routes Not Being Advertised
Symptoms: Routes missing from BGP peer, branches cannot reach DC
Troubleshooting Steps:
1. Verify routes in table:
dump routes
2. Check route map filters:
Configuration → Routing → Route Maps
# Review permit/deny clauses
3. Verify prefix lists:
# Ensure prefixes not filtered
4. Check "Distribute to Fabric" setting:
Configuration → Routing → Peers
# For DC: Verify enabled for branch prefixes
5. Review scope setting:
# Local scope won't advertise to fabric
6. Check BGP peer type (DC):
# Core peers receive branch prefixes
# Edge peers do not receive advertisements
7. Verify tunnel status:
dump tunnels
# Routes advertised only if tunnel up
8. Check host tracking (DC):
# If tracking fails, routes not advertised
Resolution:
- Adjust route map filters
- Enable "Distribute to Fabric"
- Change scope to Global
- Fix tunnel connectivity
- Resolve host tracking issues
- Use correct peer type for desired behavior
OSPF Adjacency Issues
Symptoms: OSPF neighbor not forming, routes not learned
Troubleshooting Steps:
1. Verify OSPF configuration:
Configuration → Routing → OSPF
2. Check OSPF neighbors:
dump ospf neighbors
3. Verify interface configuration:
dump interface
# Ensure interface in correct area
4. Check hello/dead intervals:
# Must match with peer
5. Verify area configuration:
# Area ID and type must match
6. Check authentication:
# If configured, must match peer
7. Review MTU:
# MTU mismatch can prevent adjacency
8. Check network type:
# Broadcast, P2P, NBMA must be appropriate
Resolution:
- Match timers with peer
- Correct area configuration
- Fix authentication mismatch
- Adjust MTU if needed
- Select appropriate network type
Policy Issues
Traffic Not Following Expected Path
Symptoms: Traffic using suboptimal path, not matching policy
Troubleshooting Steps:
1. Verify path policy configuration:
Configuration → Policies → Path
# Review rule order and matching criteria
2. Check policy binding:
Configuration → Policies → Bind to Sites
# Ensure correct stack assigned to site
3. Review application identification:
Analyze → Flows
# Verify app correctly identified
4. Check path availability:
inspect paths
# Verify intended path is available
5. Review SLA compliance:
Dashboard → Link Quality
# Check if SLA thresholds met
6. Verify network context:
# If using, ensure correct context assigned
7. Check prefix filters:
# May be overriding app-based selection
8. Review path selection logic:
# Active vs Backup vs L3 Failure paths
Resolution:
- Adjust rule order (higher priority = lower order number)
- Fix application definition
- Relax SLA thresholds if too strict
- Add/modify prefix filters
- Ensure proper network context assignment
- Review and adjust path selection criteria
Security Policy Blocking Legitimate Traffic
Symptoms: Connections denied, applications failing
Troubleshooting Steps:
1. Review security logs:
Incidents & Alerts → Filter by Security category
2. Check denied flows:
Analyze → Flows
# Filter for denied/rejected flows
3. Verify zone assignment:
Configuration → Sites → Networks
# Ensure interfaces in correct zones
4. Review security rules:
Configuration → Policies → Security
# Check rule order and matching criteria
5. Test with permissive rule:
# Temporarily add allow-all rule
# Identify where blocking occurs
6. Check application identification:
# May be misidentified
7. Verify User-ID:
# If using user-based policies
8. Review prefix filters:
# May be incorrect source/dest filters
Resolution:
- Add explicit allow rules
- Correct zone assignments
- Fix application identification
- Adjust rule order
- Update prefix filters
- Verify User-ID integration
QoS Not Applied Correctly
Symptoms: Priority traffic experiencing delays, wrong queue assignment
Troubleshooting Steps:
1. Verify QoS policy:
Configuration → Policies → QoS
2. Check policy binding:
# Ensure QoS stack assigned to site
3. Review queue statistics:
inspect qos
4. Verify application classification:
Analyze → Flows
# Check app identification
5. Check DSCP marking:
# Verify DSCP values in packets
dump flows
6. Review circuit capacity:
Configuration → Policies → Circuit Capacities
# Ensure proper allocation
7. Verify priority assignment:
# Check rule matching criteria
8. Test with higher priority:
# Temporarily elevate priority to confirm
Resolution:
- Correct QoS rule matching
- Adjust priority classes
- Fix DSCP marking
- Update circuit capacity allocation
- Ensure correct app identification
- Review and optimize rule order
Hardware and Device Issues
High CPU/Memory Utilization
Symptoms: Device slow to respond, flow processing delays
Troubleshooting Steps:
1. Check system resources:
dump system
2. Review flow count:
dump flows | count
3. Check tunnel count:
dump tunnels | count
4. Verify software version:
# Older versions may have known issues
5. Review policy complexity:
# Too many rules can impact performance
6. Check for loops:
# Routing loops or broadcast storms
7. Monitor over time:
Dashboard → Device Health
# Look for trends
Resolution:
- Upgrade to latest software version
- Simplify policies where possible
- Add more devices to distribute load
- Upgrade to higher-capacity model
- Investigate and fix routing loops
- Clear unnecessary flows/states
Interface Flapping
Symptoms: Interface going up/down repeatedly
Troubleshooting Steps:
1. Check physical layer:
# Cable, SFP, fiber quality
2. Review interface logs:
dump interface <interface-name>
3. Check for errors:
inspect interface <interface-name>
# CRC errors, frame errors
4. Verify duplex/speed:
# Auto-negotiation issues
5. Check power budget:
# For PoE devices
6. Review ISP circuit:
# Coordinate with provider
7. Test with different cable:
# Rule out cable issues
Resolution:
- Replace faulty cables/SFPs
- Hard-code speed/duplex if auto-neg failing
- Work with ISP on circuit issues
- Replace hardware if defective
- Check for EMI/environmental issues
Device Temperature High
Symptoms: Temperature alert, device slowdown or shutdown
Troubleshooting Steps:
1. Check temperature reading:
dump system
2. Verify airflow:
# Ensure vents not blocked
3. Check ambient temperature:
# Room cooling adequate?
4. Review fan operation:
# Fans spinning normally?
5. Check for dust buildup:
# Clean if necessary
6. Verify rack airflow:
# Hot aisle/cold aisle setup
Resolution:
- Improve room cooling
- Clean device vents
- Ensure proper rack spacing
- Consider ION 3200H for harsh environments
- Replace fans if faulty
- Relocate device if environmental issues
CloudBlade Integration Issues
Prisma Access CloudBlade Tunnel Issues
Symptoms: Tunnel to Prisma Access not establishing, traffic not flowing
Troubleshooting Steps:
1. Verify CloudBlade installation:
Configuration → CloudBlades
# Check status is "Installed" and "Enabled"
2. Check circuit tagging:
# Ensure AUTO-prisma-access tag applied
3. Review tunnel status:
dump servicelink summary
dump servicelink status slname=<name>
4. Verify IPSec profile:
Configuration → CloudBlades → Prisma Access
# Check profile name matches
5. Check Prisma Access configuration:
# Verify service connection or manual setup
6. Review security policies:
# Ensure zones allow Prisma Access traffic
7. Check DNS resolution:
# Prisma Access PoP reachability
8. Verify licensing:
# Prisma Access license active
Resolution:
- Reinstall CloudBlade if corrupted
- Correct circuit tagging
- Fix IPSec profile mismatch
- Update Prisma Access configuration
- Add security exceptions
- Verify and renew licenses
AWS Transit Gateway CloudBlade Issues
Troubleshooting Steps:
1. Verify AWS credentials:
Configuration → CloudBlades → AWS TGW
2. Check IAM permissions:
# Ensure CloudBlade has required permissions
3. Review VPC configuration:
# Verify VPC attachment to TGW
4. Check BGP sessions:
dump bgp peers
# Verify peering with TGW
5. Review route propagation:
# AWS console: Check TGW route tables
6. Verify security groups:
# Allow required traffic
7. Check vION health:
# Both instances in HA pair healthy
Resolution:
- Update AWS credentials
- Fix IAM permissions
- Correct VPC/TGW configuration
- Troubleshoot BGP peering
- Update security groups
- Resolve vION HA issues
Advanced Troubleshooting Techniques
Packet Capture
debug tcpdump interface eth1
debug tcpdump interface eth1 host 10.1.1.1
debug tcpdump interface eth1 -w capture.pcap
debug tcpdump interface eth1 "tcp port 443 and host 10.1.1.1"
Flow Analysis
1. Navigate: Analyze → Flows
2. Apply filters:
- Time range
- Site
- Application
- Source/Destination IP
- Interface
3. Review metrics:
- Bandwidth utilization
- Packet loss
- Latency
- Path selected
4. Export for offline analysis
5. Correlate with incidents
Log Collection
1. Navigate: Configuration → ION Devices → Device
2. Select Tools → Collect Logs
3. Select log types:
- System logs
- Event logs
- Debug logs
4. Download log bundle
5. Review or send to support
Remote Support Access
1. Navigate: Configuration → ION Devices → Device
2. Select Tools → Enable Remote Support
3. Generate support PIN
4. Provide PIN to Palo Alto Networks support
5. Support can remote troubleshoot
6. Disable when complete
Performance Baselining
Establishing Baselines
1. Deploy in Analytics mode initially
2. Monitor for 2-4 weeks
3. Document:
- Typical bandwidth usage per circuit
- Application mix and bandwidth
- Peak usage times
- Link quality metrics
- Number of flows/sessions
4. Use baseline for:
- Capacity planning
- SLA threshold setting
- Anomaly detection
- Policy optimization
Key Metrics to Track
Circuit Metrics:
- Bandwidth utilization (avg, 95th percentile)
- Latency (min, avg, max)
- Packet loss percentage
- Jitter
- MOS score
Application Metrics:
- Transaction success rate
- Response time
- Throughput
- Active sessions
Device Metrics:
- CPU utilization
- Memory utilization
- Flow count
- Tunnel count
- Queue drops
Best Practices
Design Best Practices
-
Start Simple, Scale Gradually
- Begin with Simple policy stacks
- Move to Advanced policies only when needed
- Avoid over-engineering initial deployment
-
Use Network Contexts for Segmentation
- Prefer network contexts over VRFs for most use cases
- Simpler to manage and troubleshoot
- Adequate for most segmentation needs
-
Plan for High Availability
- Deploy DC IONs in HA pairs
- Use BGP for DC HA (required)
- Deploy virtual IONs in different availability zones
- Implement host tracking for DC failover
-
Leverage CloudBlades
- Use CloudBlades instead of manual integrations
- Reduces configuration complexity
- Automatic updates and maintenance
- Request from support if not available in tenant
-
Design for Scalability
- Plan for 30-50% growth in first year
- Right-size devices for throughput needs
- Consider management scalability (MSPs)
- Use templates for repeatable configurations
Operational Best Practices
-
Policy Management
- Document policy intent
- Use naming conventions consistently
- Review policies quarterly
- Remove unused rules
- Test policy changes in lab/pilot
-
Monitoring and Alerting
- Configure incident policies for proactive alerts
- Set realistic thresholds (avoid alert fatigue)
- Enable syslog for long-term retention
- Use SNMP for integration with monitoring platforms
- Review dashboards weekly
-
Change Management
- Schedule changes during maintenance windows
- Test in non-production first
- Document rollback procedures
- Notify stakeholders
- Monitor post-change for issues
-
Software Management
- Stay current with software releases (within 2-3 releases)
- Review release notes thoroughly
- Pilot on non-critical sites first
- Maintain previous version for rollback
- Coordinate DC and branch upgrades
-
Security Hygiene
- Regularly audit ZBFW policies
- Implement least-privilege access
- Monitor security logs
- Keep application signatures updated
- Integrate with Prisma Access for advanced security
-
Documentation
- Maintain network diagrams
- Document custom applications
- Keep runbooks updated
- Document security zones and policies
- Track configuration changes
Troubleshooting Best Practices
-
Methodical Approach
- Define the problem clearly
- Gather relevant information
- Form hypothesis
- Test systematically
- Document findings
-
Use Built-in Tools First
- Check dashboards before CLI
- Review incidents and alerts
- Use flow browser for traffic analysis
- Leverage predictive analytics
- CLI when detailed troubleshooting needed
-
Engage Support Effectively
- Collect logs before contacting support
- Provide clear problem description
- Document troubleshooting steps taken
- Enable remote support access
- Follow up on recommendations
-
Knowledge Building
- Participate in Palo Alto Networks community
- Review best practices documentation
- Take training courses
- Lab test before production changes
- Share knowledge within team
Reference Information
Port Requirements
ION to Controller
- TCP 443 (HTTPS): Management and control
- NTP (UDP 123): Time synchronization
- DNS (UDP 53): Name resolution
ION to ION (Prisma SD-WAN VPN)
- UDP 4500: IPSec NAT-T (primary)
- UDP 500: IKE (negotiation)
- IP Protocol 50: ESP (alternative if no NAT)
Standard VPN
- UDP 4500: IPSec NAT-T
- UDP 500: IKE
- GRE (IP Protocol 47): If using GRE tunnels
Management Access
- SSH: TCP 22 (if enabled)
- SNMP: UDP 161 (queries), UDP 162 (traps)
- Syslog: UDP 514 or TCP 514 or TCP 6514 (TLS)
Capacity Limits
Per Device
- Maximum tunnels: Varies by model (1000-5000+)
- Maximum flows: Varies by model (100K-1M+)
- Maximum routes: 1M+ (DC models)
- Maximum BGP peers: 100+ (DC models)
- Maximum policy rules: 1000s
Per Tenant
- Maximum sites: 10,000+
- Maximum devices: 10,000+
- Maximum policies: 1000s per type
Software Versions
Current Releases (as of knowledge cutoff)
- Latest: 6.5.x series
- Previous: 6.4.x series
- Minimum supported: 6.1.x+ (check compatibility matrix)
Upgrade Path
- Can skip intermediate versions in most cases
- Review release notes for specific path requirements
- Controller upgraded automatically (SaaS)
- ION devices upgraded by administrator
Supported Routing Protocols
Dynamic Routing
- BGP4 with 4-byte ASN support
- OSPF v2 (IPv4)
- Multicast: PIM Sparse Mode
Static Routing
- IPv4 and IPv6 static routes
- Interface-based or next-hop based
- Scope: Local or Global
Route Redistribution
- BGP ↔ OSPF
- BGP ↔ Static
- OSPF ↔ Static
- Connected routes into any protocol
Application Identification
Methods
- Layer 7 DPI (primary)
- IP/Port patterns
- DSCP marking
- SSL/TLS fingerprinting
- Behavioral analysis
Application Database
- 5000+ pre-defined applications
- Cloud-updated signatures
- Custom application support
- Application overrides available
API and Automation
REST API
- Full configuration API
- Status and statistics retrieval
- Event and alert API
- CloudBlade SDK
Python SDK
- Prisma SD-WAN Python SDK available
- Simplifies automation tasks
- Examples and documentation provided
Terraform Provider
- Infrastructure-as-code support
- Manage sites, devices, policies
- Version control friendly
Support Resources
Documentation
Community
Training
- EDU-238: Prisma SD-WAN Design and Operation
- Online learning portal
- Partner training programs
Support
Glossary
- AppFabric: Prisma SD-WAN's application-defined network fabric
- CloudBlade: API-based integration platform for third-party services
- ION: Instant-On Network device (Prisma SD-WAN appliance)
- LQM: Link Quality Monitoring
- SASE: Secure Access Service Edge
- ZBFW: Zone-Based Firewall
- ZTP: Zero-Touch Provisioning
- vION: Virtual ION (software appliance)
- Network Context: Traffic segmentation construct
- Path Stack: Collection of path policy sets
- QoS Stack: Collection of QoS policy sets
- Security Stack: Collection of security policy sets
- SLA: Service Level Agreement
- FEC: Forward Error Correction
- DPI: Deep Packet Inspection
- MOS: Mean Opinion Score (VoIP quality metric)
Usage Notes
This skill should be referenced when:
- Designing new Prisma SD-WAN deployments
- Configuring sites, devices, and policies
- Integrating with cloud services (Prisma Access, AWS, Azure)
- Troubleshooting connectivity, performance, or policy issues
- Optimizing existing Prisma SD-WAN environments
- Planning upgrades or expansions
- Implementing security policies
- Configuring dynamic routing (BGP, OSPF)
Always consult official Palo Alto Networks documentation for the most current information, as features and capabilities evolve with each software release.
