菜单
Comprehensive guide for designing, deploying, operating, and troubleshooting Palo Alto Networks Prisma SD-WAN. Covers architecture, configuration, policies, routing, and operations.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Analyze network packets using tshark (Wireshark CLI). Use when the user wants to capture live traffic, read .pcap/.pcapng files, filter packets by protocol or field, extract specific fields, drill into packet details, or generate traffic statistics. Covers live capture, pcap file analysis, display filters, field extraction, protocol drill-down, conversation stats, flow analysis, and JSON/PDML output for programmatic processing.
Automate EVE-NG network emulation lab creation, management, and topology deployment using evengsdk Python library and CLI. Use when you need to (1) Create or manage EVE-NG virtual network labs programmatically, (2) Deploy network topologies from YAML definitions, (3) Configure virtual network devices with templates or files, (4) Build automated test environments for network validation, (5) Manage nodes, networks, and links in EVE-NG labs, (6) Integrate network lab provisioning into CI/CD pipelines
Interact with Juniper Mist WiFi API. Use when managing Mist orgs, sites, or APs.
Interact with the Juniper Mist WiFi cloud API to manage organizations, sites, access points, WLANs, clients, and retrieve stats. Use when the user wants to automate, query, or configure any aspect of a Juniper Mist wireless environment via REST API. Covers authentication setup, endpoint selection by region, and common CRUD operations across org and site scopes.
Living knowledge base of enterprise network infrastructure including topology, IP addressing, VLANs, monitoring tools, and security policies. Automatically updated as new network information is discovered during agent tasks.
Comprehensive network device automation using Ansible. Use when the agent needs to work with Ansible playbooks, inventories, or configurations for network devices (routers, switches, firewalls). Covers Cisco IOS/NX-OS/ASA, Juniper Junos, Arista EOS, and other network platforms. Use for creating playbooks, managing device configurations, gathering facts, troubleshooting network automation, or working with network modules.
基于 SOC 职业分类
| name | prisma-sdwan |
| description | Comprehensive guide for designing, deploying, operating, and troubleshooting Palo Alto Networks Prisma SD-WAN. Covers architecture, configuration, policies, routing, and operations. |
| license | Proprietary |
| metadata | {"version":"1.0"} |
This skill provides comprehensive guidance for designing, deploying, operating, and troubleshooting Palo Alto Networks Prisma SD-WAN environments. Prisma SD-WAN is a cloud-delivered, application-defined SD-WAN solution that forms a key component of the SASE (Secure Access Service Edge) framework.
Cloud Controller (SaaS)
ION Devices (Data Plane)
ION Fabric
Management Platforms
Analytics Mode
Control Mode
Disabled Mode
Layer 2-Only Model
Layer 2/Layer 3 Model
Router Replacement Model
BGP-Based DC Deployment (Off-Path)
OSPF-Based DC Deployment (In-Path)
DC Peer Types
Branch HA
Data Center HA
Virtual ION HA
Network Contexts
Security Zones
Prerequisites
Activation Steps
1. Access Strata Cloud Manager
2. Navigate to Activation & Onboarding
3. Claim ION devices using serial numbers
4. Assign appropriate software subscription
5. Configure basic site information
Zero-Touch Provisioning (ZTP)
Create Site
Configuration → Prisma SD-WAN → Sites → Add Site
- Site Name, Description, Tags
- Address and Location
- Site Type: Branch or Data Center
- Admin State: Active, Monitor, or Disabled
Configure Device Basic Info
Configuration → Prisma SD-WAN → ION Devices → Claimed → Configure
Basic Info Tab:
- Device Name
- Deployment Mode: Analytics, Control, Disabled
- Enable L3 Direct Private WAN Forwarding (if using L3 private WAN)
- Enable L3 LAN Forwarding (for dynamic LAN routing)
Note: L3 LAN Forwarding requires no Private L2 bypass pairs configured
Circuit Categories
Configure Circuits
Configuration → Prisma SD-WAN → Sites → Site → Circuits
- Circuit Name
- Category (MPLS, Internet, etc.)
- Bandwidth (Download/Upload)
- Circuit Type: Public, Private, or Private WAN
- Enable Device-Initiated Connections (for NAT traversal)
Interface Configuration
Configuration → Prisma SD-WAN → ION Devices → Interfaces
- Assign interface to circuit
- Configure IP addressing (Static, DHCP, PPPoE)
- VLAN tagging if required
- MTU configuration
- Enable/disable interfaces as needed
Bypass Pairs (Layer 2)
LAG/LACP Support
Branch Static Routes
Configuration → ION Devices → Device → Routing → Static Routes
- Destination Network
- Next Hop (IP or Interface)
- Scope: Local or Global
- Local: Not advertised to fabric
- Global: Advertised to other sites
Use Cases
BGP Global Configuration
Configuration → ION Devices → Device → Routing → BGP Global
- Local AS Number (1-4294967295, 4-byte ASN support)
- Router ID (IPv4 address, must be same within VRF)
- Timers: Keepalive (3-60s), Hold (9-180s)
- Maximum Paths for ECMP
Create BGP Peer
Configuration → ION Devices → Device → Routing → Create Peer
Peer Information:
- Name, Description, Tags
- VRF: Global or custom VRF
- Peer IP Address (IPv4/IPv6)
- Remote AS Number
- Peer Type (DC only): Core, Edge, Classic
- Router ID
- Update Source IP (multi-hop scenarios)
Route Maps:
- Route Map In: Filter incoming routes
- Route Map Out: Filter outgoing routes
- Advertise Default to Peer (optional)
Override Global Configs (optional):
- Keepalive Time
- Hold Time
- Maximum Paths
- Authentication (MD5 password)
BGP Peer Types (Data Center)
Branch BGP
Route Advertisement Controls
OSPF Support (Available 6.4.1+)
Prerequisites
Enable both:
- L3 Direct Private WAN Forwarding
- L3 LAN Forwarding
Remove all Private L2 bypass pairs
Configure OSPF
Configuration → ION Devices → Device → Routing → OSPF
OSPF Infra Settings:
- Edit Route Maps and Prefix Lists
Create OSPF Configuration:
General Tab:
- Name
- VRF (Global or custom)
- Router ID (optional, IPv4 address)
- LAN Prefix Advertisement (Default: 0.0.0.0/0 only)
- LAN Advertisement Route Map (optional)
- Redistribute BGP (optional)
- Scope: Local or Global
Area & Interfaces Tab:
- Area ID (x.x.x.x format)
- Area Type: Standard, Stub, NSSA, Totally Stub, Totally NSSA
- Add Interfaces to area
- Interface timers:
* Hello Interval (1-65535s, default 10)
* Dead Interval (1-65535s, default 40)
* Retransmit Interval (1-65535s, default 5)
* Transit Delay (1-65535s, default 1)
- Authentication: None, Plain Text, MD5
- Network Type: Broadcast, Point-to-Point, NBMA
Route Redistribution
Stack Types
Policy Categories
Create Path Policy Set
Configuration → Prisma SD-WAN → Policies → Path → Path Stacks → Advanced
Add Path Policy Set:
- Default Rule Policy Set (includes Default + Enterprise Default)
- Create from Template
- Clone from existing Policy Set
- Blank policy set
Set Attributes:
- Name, Description, Tags
Add Path Policy Rule
Select Path Set → Add Rule
Info Tab:
- Name, Order (default 1024)
- Description, Tags
- Enable/Disable rule
Prefixes Tab:
- Source Prefix Filter (optional)
- Destination Prefix Filter (optional)
- Network Context (optional)
Apps Tab:
- Select Applications (up to 256 per rule)
- Filter: For sites 6.0.1+, below 6.0.1, any site
- Application types: System (PANW), System (CGX), Custom
Paths Tab:
Path Selection Method:
1. SLA Compliant Path:
- Define SLA metrics: Latency, Loss, Jitter, MOS
- Probe metrics: ICMP, DNS, HTTP/S
- App metrics: TCP Init Failure, RTT, TRT (UDP)
- Active Paths (required): SLA-compliant paths
- Backup Paths (optional): Used if active paths non-compliant
- L3 Failure Paths (optional): Emergency route for L3 failures
2. Best Path Selection:
- Selects optimal path dynamically
- No SLA constraints
Per Path Configuration:
- Overlay: Direct, Prisma SD-WAN VPN, Standard VPN
- Circuit Category: Select appropriate category
- Cannot repeat overlay + circuit category combination
Path Policy Precedence (Longest Match, Ascending Order)
Path Selection Logic
Create QoS Policy Set
Configuration → Prisma SD-WAN → Policies → QoS → QoS Stacks → Advanced
Add QoS Policy Set:
- Default Rule Policy Set
- Create from Template
- Clone from Policy Set
- Blank policy set
Add QoS Policy Rule
Select QoS Set → Add Rule
Info Tab:
- Name, Order (default 1024)
- Description, Tags
Prefixes Tab:
- Network Context (highest precedence)
- Source Prefix Filter
- Destination Prefix Filter
Apps Tab:
- Select Applications (up to 256 per rule)
Priority Tab:
- Priority Class: Determines queue assignment
* Real-Time (highest)
* Critical
* Important
* Default
* Bulk (lowest)
- Circuit Capacity Reference (for bandwidth allocation)
DSCP Tab:
- No Action: Leave DSCP unchanged
- Mark/Remark: Set DSCP value (0-63)
- Applied LAN-to-WAN direction
QoS Policy Precedence (Same as Path)
Circuit Capacity Configuration
Configuration → Prisma SD-WAN → Policies → Circuit Capacities
- Define bandwidth allocation per priority class
- Percentage-based allocation
- Applied to QoS rules
Zone-Based Firewall (ZBFW)
Create Security Zone
Configuration → Prisma SD-WAN → Policies → Security → Security Zones
Add Security Zone:
- Name, Description, Tags
- Assign to networks/interfaces at site level
Create Security Policy Stack
Configuration → Prisma SD-WAN → Policies → Security → Security Stacks
Add Security Stack:
- Name, Description, Tags
- Select security policy sets (up to 4 + default)
Add Security Policy Set
Add Security Policy Set:
- Default Rule Policy Set (includes 3 default rules)
- Clone from existing set
- Blank policy set
Add Security Policy Rule
Select Security Set → Add Rule
Info Tab:
- Name, Order
- Description, Tags
Zones Tab:
- Source Zone(s)
- Destination Zone(s)
Prefixes Tab:
- Source Prefix Filter (optional)
- Destination Prefix Filter (optional)
Apps Tab:
- Select Applications
Ports Tab (optional):
- Source Ports
- Destination Ports
- Protocol
Users/Groups Tab (optional):
- User ID filtering
- Group ID filtering
Action Tab:
- Allow: Permit traffic
- Deny: Drop silently (no ICMP/RST)
- Reject: Drop with ICMP unreachable or TCP RST
Logging Tab:
- Enable/disable logging
- Syslog profile selection
Default Security Rules
Security Features
Forward Error Correction (FEC)
Configuration → Prisma SD-WAN → Policies → Performance
Create Performance Policy:
- Select Applications
- SLA Thresholds: Latency, Loss, Jitter
- Action: Enable FEC + Packet Duplication
- Apply when SLA violation detected
Bandwidth Steering
Configuration → Prisma SD-WAN → Policies → NAT
Add NAT Rule:
- Source/Destination prefixes
- NAT type: Source NAT, Destination NAT
- NAT pool or interface-based NAT
- Port Address Translation (PAT)
Bind to Sites
Configuration → Prisma SD-WAN → Policies → Bind to Sites
- Select sites (single or multiple)
- Assign Path Stack
- Assign QoS Stack
- Assign Security Stack
- Assign NAT Stack (if applicable)
- Only one stack of each type per site
System Applications
Custom Applications
Configuration → Prisma SD-WAN → Policies → Custom Applications
Add Custom Application:
- Name, Description, Tags
- Category
- Traffic Type
- Match Criteria:
* IP Prefix
* IP Protocol
* L4 Ports (TCP/UDP)
* DSCP values
- Bidirectional matching option
System Application Overrides
CloudBlade Platform
Common CloudBlades
Prisma Access Integration
Configuration → Prisma SD-WAN → CloudBlades → Prisma Access
Requirements:
- Prisma Access subscription
- Prisma SD-WAN 5.2.1+
- IPSec profile configured
Configuration:
- Select Prisma Access cloud
- Service Connection or Manual Setup
- Auto-tunnel creation to nearest Prisma Access PoP
- Tag-based automation (AUTO-prisma-access)
AWS Transit Gateway CloudBlade
Configuration → Prisma SD-WAN → CloudBlades → AWS TGW
Features:
- Automated vION HA deployment
- Auto-connectivity to Transit Gateway
- Multi-region support
- BGP session automation
Azure Virtual WAN CloudBlade
Configuration → Prisma SD-WAN → CloudBlades → Azure vWAN
Features:
- Auto-configuration of secure tunnels
- Integration with Azure backbone
- Direct cloud access optimization
- Simplified vWAN hub connectivity
Zscaler Integration CloudBlade
Configuration → Prisma SD-WAN → CloudBlades → Zscaler
Support:
- IPSec tunnels (AUTO-zscaler tag)
- GRE tunnels (AUTO-zscaler-GRE tag - v2.0.0+)
- Automatic tunnel to Zscaler nodes
- Tag-based site enrollment
Configuration:
- Zscaler cloud selection
- Partner admin credentials
- API key configuration
- IPSec profile name
Other CloudBlades
Dashboard Views
Prisma SD-WAN Summary Dashboard
Navigation: Dashboard → Prisma SD-WAN Summary
- ION device connectivity status
- Link quality metrics (latency, loss, jitter, MOS)
- Top sites by alarms
- Application utilization (top 10 by bandwidth)
- Active links table
- Secure fabric tunnel status
Site Summary Dashboard
Navigation: Dashboard → Sites → Select Site
- Site health score
- Active/inactive circuits
- Application performance metrics
- Path selection statistics
- Security events
- Device status
Predictive Analytics Dashboard
Navigation: Dashboard → Predictive Analytics
- ML-based anomaly detection
- Proactive issue identification
- Site health trends
- Application health scoring
- Capacity planning insights
Application Dashboard
Navigation: Dashboard → Applications
- Application identification statistics
- Per-app performance metrics
- Transaction success/failure rates
- Top applications by bandwidth, sessions
- App-to-path mapping
Link Quality Dashboard
Navigation: Dashboard → Link Quality
- Per-link performance metrics
- Latency, loss, jitter, MOS trends
- Circuit health scoring
- Comparative link analysis
- Historical performance data
Flow Browser
Navigation: Analyze → Flows
- Real-time and historical flow data
- Filter by: Site, App, User, Interface, Zone
- Per-flow metrics: Bandwidth, packets, latency, loss
- Export to CSV for offline analysis
- Drill-down into specific sessions
Alert Categories
Incident Types
Incident Management
Navigation: Incidents & Alerts → Troubleshooting
Actions:
- Acknowledge: Mark awareness, no immediate action
- Unacknowledge: Return to active incident queue
- Filter: By severity, priority, category, site, time
- Troubleshoot: Follow guided troubleshooting steps
- Go to Support: Create support ticket
Filters Available:
- Admin State: Active, Monitor, Disabled
- Severity: Critical, Warning, Informational
- Priority: P1 (highest) to P4 (lowest)
- Category: Network, Device, Cellular, Authentication
- Code: Specific event codes
- Time: Chronological sorting
- Correlation ID: Related incidents
Incident Policies
Configuration → Prisma SD-WAN → Policies → Incident Policies
Create Custom Thresholds:
- Latency thresholds
- Loss percentage thresholds
- Jitter thresholds
- Bandwidth utilization alerts
- Device CPU/memory thresholds
- Temperature alerts
- Custom notification rules
SNMP Integration
Configuration → Prisma SD-WAN → Configuration → SNMP
Configure SNMP:
- SNMP v2c or v3
- Community strings (v2c)
- Authentication/Privacy (v3)
- Trap destinations
- MIB support for monitoring platforms
Syslog Integration
Configuration → Prisma SD-WAN → Policies → Syslog Profiles
Configure Syslog:
- Syslog server IP/hostname
- Port (default 514)
- Protocol: UDP, TCP, TLS
- Facility codes
- Severity filtering
- Associate with security policies
Device Claiming
1. Unbox ION device
2. Connect controller port to internet
3. Power on device
4. Navigate: Configuration → ION Devices → Unclaimed
5. Claim using serial number or auto-discovery
6. Assign to site
7. Apply configuration template
8. Monitor registration status
Software Upgrade
Configuration → ION Devices → Software Management
Process:
1. Review release notes
2. Schedule maintenance window
3. Select target version
4. Stage software to devices
5. Activate upgrade (per device or bulk)
6. Monitor upgrade progress
7. Verify post-upgrade health
8. Rollback if necessary (automatic on failure)
Best Practices:
- Upgrade controller components first
- Pilot upgrade on test/non-critical sites
- Perform upgrades during maintenance windows
- Maintain previous version for rollback
- Upgrade DC sites before branches
Configuration Backup
Configuration → ION Devices → Configuration Backup
Capabilities:
- Automatic daily backups
- Manual backup on-demand
- Configuration versioning
- Restore to previous configuration
- Export configuration as JSON
- Compare configuration versions
RMA Process (Enhanced in 6.5+)
1. Identify failed device
2. Navigate: Configuration → ION Devices → RMA
3. Select device for replacement
4. Provision replacement device
5. Ship replacement to site
6. Site personnel swap device (ZTP takeover)
7. Old device auto-deregistered
8. Return failed device
Path Selection Tuning
QoS Optimization
Bandwidth Management
Link Quality Monitoring
ZBFW Policy Review
User-ID Integration
Threat Intelligence
Monitoring Key Metrics
Scaling Considerations
Access Methods
Via Web Interface
1. Navigate: Configuration → ION Devices → Device
2. Select Tools → Device Toolkit
3. Opens CLI session in browser
4. Requires device credentials
Via SSH (If enabled)
ssh username@device-ip
Requires:
- SSH enabled on device
- User credentials configured
- Network reachability
User Roles with CLI Access
Clear Commands (Session/statistics clearing)
# Clear ARP cache
clear arp
# Clear BGP sessions
clear bgp [all|ipv4|ipv6]
# Clear route cache
clear routes
# Clear flow statistics
clear flows
Config Commands (Runtime configuration)
# Show running configuration
config show
# Configure static host
config static host <hostname> <ip-address>
# View interface configuration
config interface <interface-name>
Debug Commands (Active troubleshooting)
# Packet capture on interface
debug tcpdump interface <interface-name> [filter]
Example: debug tcpdump interface eth1 host 10.1.1.1
# Ping from ION device
debug ping <destination> [-c count] [-i interval]
# Traceroute
debug traceroute <destination>
# ARP interface operations
debug arping interface <interface-name> <target-ip>
# Reboot device
debug reboot [now|delayed]
# Interface debugging
debug interface <interface-name>
# Routing debugging
debug routing [bgp|ospf|static]
Dump Commands (State information)
# Interface status
dump interface [interface-name]
Example output:
Interface: eth1
Status: up
IP: 10.10.10.1/24
MAC: 00:11:22:33:44:55
# BGP peer status
dump bgp peers
Shows: Peer state, uptime, prefixes received/advertised
# Route table
dump routes [ipv4|ipv6]
# Tunnel status
dump tunnels
Shows: Tunnel state, encryption, metrics
# Service link status (Standard VPNs)
dump servicelink summary
Example output:
-------------- SERVICE LINKS ----------------------------------
Total : 1
TotalUP : 1
TotalDown : 0
---------------------------------------------------------------
dump servicelink status slname=<name>
Shows: IKE/IPSec SA details, encryption, timers
dump servicelink stats slname=<name>
Shows: Rekey counts, tunnel up/down events, byte/packet counters
# Flow information
dump flows [filter options]
Example: dump flows application=Office365
# System information
dump system
Shows: CPU, memory, disk, uptime, version
# OSPF neighbors (if configured)
dump ospf neighbors
# Multicast state
dump multicast
Inspect Commands (Detailed inspection)
# Application identification status
inspect apps
# Path selection details
inspect paths
# QoS queue status
inspect qos
# Security policy hits
inspect security
# Circuit health
inspect circuits
# Detailed interface statistics
inspect interface <interface-name>
SpeedTest CLI Utility (6.3.6+)
# Run speedtest on circuit
speedtest --interface <interface-name>
# Output: Download speed, upload speed, latency
ION Not Registering to Controller
Symptoms: Device shows offline, not appearing in Claimed Devices
Troubleshooting Steps:
1. Verify physical connectivity:
- Check cable connections
- Verify link lights on controller port
2. Check IP connectivity:
# From CLI:
debug ping 8.8.8.8
debug ping controller.paloaltonetworks.com
3. Verify DNS resolution:
config show | grep dns
4. Check NAT/Firewall:
- Ensure outbound HTTPS (443) allowed
- Check if PAT is working correctly
- Verify no SSL inspection breaking connection
5. Review device logs:
dump system
# Check for certificate or time sync issues
6. Verify controller reachability:
debug traceroute controller.paloaltonetworks.com
7. Check device claim status:
Configuration → ION Devices → Unclaimed
# Manually claim if auto-discovery failed
8. Review time synchronization:
# Ensure NTP is working
dump system | grep time
Resolution:
Tunnel Not Establishing
Symptoms: Sites cannot communicate, tunnel shows down
Troubleshooting Steps:
1. Verify tunnel configuration:
dump tunnels
# Check tunnel state, remote endpoint
2. Check circuit status:
dump interface
# Ensure underlying interface is up
3. Verify IP reachability:
debug ping <remote-site-public-ip>
4. Check NAT/Firewall:
- UDP 4500 (IPSec NAT-T)
- UDP 500 (IKE)
- Protocol 50 (ESP)
5. Review IPSec parameters:
dump servicelink status slname=<tunnel-name>
# Check encryption, authentication, DH group mismatch
6. Check MTU issues:
debug ping <remote-ip> -s 1400 -M do
# Test with large packets
7. Review security policies:
# Ensure zones allow VPN traffic
inspect security
8. Check path selection:
inspect paths
# Verify tunnel is being selected
Resolution:
Poor Application Performance
Symptoms: High latency, packet loss, slow application response
Troubleshooting Steps:
1. Identify affected application:
Navigate: Analyze → Flows
Filter by application
2. Check path selection:
inspect paths
# Verify optimal path being used
3. Review link quality:
Navigation: Dashboard → Link Quality
# Check latency, loss, jitter on active path
4. Verify QoS policy:
Configuration → Policies → QoS
# Ensure app has correct priority
5. Check circuit utilization:
dump interface <interface>
# Look for saturation
6. Review path policy:
# Verify SLA thresholds appropriate
# Check if backup path should be used
7. Enable FEC if lossy path:
Configuration → Policies → Performance
# Add performance policy with FEC
8. Check application identification:
inspect apps
# Verify app correctly identified
9. Analyze flow metrics:
dump flows application=<app-name>
# Review per-flow statistics
Resolution:
BGP Peer Not Establishing
Symptoms: BGP peer state shows Idle, Connect, or Active
Troubleshooting Steps:
1. Verify BGP peer status:
dump bgp peers
2. Check IP reachability:
debug ping <peer-ip>
3. Verify BGP configuration:
Configuration → ION Devices → Routing → Peers
# Check peer IP, AS number, authentication
4. Review firewall rules:
# Ensure TCP 179 allowed
inspect security
5. Check for AS number mismatch:
# Local AS vs Remote AS
6. Verify MD5 authentication:
# If configured, ensure password matches
7. Review router logs:
# Check for error messages in peer logs
8. Check for routing loops:
dump routes
# Verify no conflicting routes
Resolution:
Routes Not Being Advertised
Symptoms: Routes missing from BGP peer, branches cannot reach DC
Troubleshooting Steps:
1. Verify routes in table:
dump routes
2. Check route map filters:
Configuration → Routing → Route Maps
# Review permit/deny clauses
3. Verify prefix lists:
# Ensure prefixes not filtered
4. Check "Distribute to Fabric" setting:
Configuration → Routing → Peers
# For DC: Verify enabled for branch prefixes
5. Review scope setting:
# Local scope won't advertise to fabric
6. Check BGP peer type (DC):
# Core peers receive branch prefixes
# Edge peers do not receive advertisements
7. Verify tunnel status:
dump tunnels
# Routes advertised only if tunnel up
8. Check host tracking (DC):
# If tracking fails, routes not advertised
Resolution:
OSPF Adjacency Issues
Symptoms: OSPF neighbor not forming, routes not learned
Troubleshooting Steps:
1. Verify OSPF configuration:
Configuration → Routing → OSPF
2. Check OSPF neighbors:
dump ospf neighbors
3. Verify interface configuration:
dump interface
# Ensure interface in correct area
4. Check hello/dead intervals:
# Must match with peer
5. Verify area configuration:
# Area ID and type must match
6. Check authentication:
# If configured, must match peer
7. Review MTU:
# MTU mismatch can prevent adjacency
8. Check network type:
# Broadcast, P2P, NBMA must be appropriate
Resolution:
Traffic Not Following Expected Path
Symptoms: Traffic using suboptimal path, not matching policy
Troubleshooting Steps:
1. Verify path policy configuration:
Configuration → Policies → Path
# Review rule order and matching criteria
2. Check policy binding:
Configuration → Policies → Bind to Sites
# Ensure correct stack assigned to site
3. Review application identification:
Analyze → Flows
# Verify app correctly identified
4. Check path availability:
inspect paths
# Verify intended path is available
5. Review SLA compliance:
Dashboard → Link Quality
# Check if SLA thresholds met
6. Verify network context:
# If using, ensure correct context assigned
7. Check prefix filters:
# May be overriding app-based selection
8. Review path selection logic:
# Active vs Backup vs L3 Failure paths
Resolution:
Security Policy Blocking Legitimate Traffic
Symptoms: Connections denied, applications failing
Troubleshooting Steps:
1. Review security logs:
Incidents & Alerts → Filter by Security category
2. Check denied flows:
Analyze → Flows
# Filter for denied/rejected flows
3. Verify zone assignment:
Configuration → Sites → Networks
# Ensure interfaces in correct zones
4. Review security rules:
Configuration → Policies → Security
# Check rule order and matching criteria
5. Test with permissive rule:
# Temporarily add allow-all rule
# Identify where blocking occurs
6. Check application identification:
# May be misidentified
7. Verify User-ID:
# If using user-based policies
8. Review prefix filters:
# May be incorrect source/dest filters
Resolution:
QoS Not Applied Correctly
Symptoms: Priority traffic experiencing delays, wrong queue assignment
Troubleshooting Steps:
1. Verify QoS policy:
Configuration → Policies → QoS
2. Check policy binding:
# Ensure QoS stack assigned to site
3. Review queue statistics:
inspect qos
4. Verify application classification:
Analyze → Flows
# Check app identification
5. Check DSCP marking:
# Verify DSCP values in packets
dump flows
6. Review circuit capacity:
Configuration → Policies → Circuit Capacities
# Ensure proper allocation
7. Verify priority assignment:
# Check rule matching criteria
8. Test with higher priority:
# Temporarily elevate priority to confirm
Resolution:
High CPU/Memory Utilization
Symptoms: Device slow to respond, flow processing delays
Troubleshooting Steps:
1. Check system resources:
dump system
2. Review flow count:
dump flows | count
3. Check tunnel count:
dump tunnels | count
4. Verify software version:
# Older versions may have known issues
5. Review policy complexity:
# Too many rules can impact performance
6. Check for loops:
# Routing loops or broadcast storms
7. Monitor over time:
Dashboard → Device Health
# Look for trends
Resolution:
Interface Flapping
Symptoms: Interface going up/down repeatedly
Troubleshooting Steps:
1. Check physical layer:
# Cable, SFP, fiber quality
2. Review interface logs:
dump interface <interface-name>
3. Check for errors:
inspect interface <interface-name>
# CRC errors, frame errors
4. Verify duplex/speed:
# Auto-negotiation issues
5. Check power budget:
# For PoE devices
6. Review ISP circuit:
# Coordinate with provider
7. Test with different cable:
# Rule out cable issues
Resolution:
Device Temperature High
Symptoms: Temperature alert, device slowdown or shutdown
Troubleshooting Steps:
1. Check temperature reading:
dump system
2. Verify airflow:
# Ensure vents not blocked
3. Check ambient temperature:
# Room cooling adequate?
4. Review fan operation:
# Fans spinning normally?
5. Check for dust buildup:
# Clean if necessary
6. Verify rack airflow:
# Hot aisle/cold aisle setup
Resolution:
Prisma Access CloudBlade Tunnel Issues
Symptoms: Tunnel to Prisma Access not establishing, traffic not flowing
Troubleshooting Steps:
1. Verify CloudBlade installation:
Configuration → CloudBlades
# Check status is "Installed" and "Enabled"
2. Check circuit tagging:
# Ensure AUTO-prisma-access tag applied
3. Review tunnel status:
dump servicelink summary
dump servicelink status slname=<name>
4. Verify IPSec profile:
Configuration → CloudBlades → Prisma Access
# Check profile name matches
5. Check Prisma Access configuration:
# Verify service connection or manual setup
6. Review security policies:
# Ensure zones allow Prisma Access traffic
7. Check DNS resolution:
# Prisma Access PoP reachability
8. Verify licensing:
# Prisma Access license active
Resolution:
AWS Transit Gateway CloudBlade Issues
Troubleshooting Steps:
1. Verify AWS credentials:
Configuration → CloudBlades → AWS TGW
2. Check IAM permissions:
# Ensure CloudBlade has required permissions
3. Review VPC configuration:
# Verify VPC attachment to TGW
4. Check BGP sessions:
dump bgp peers
# Verify peering with TGW
5. Review route propagation:
# AWS console: Check TGW route tables
6. Verify security groups:
# Allow required traffic
7. Check vION health:
# Both instances in HA pair healthy
Resolution:
Packet Capture
# Capture on specific interface
debug tcpdump interface eth1
# Capture with filter
debug tcpdump interface eth1 host 10.1.1.1
# Capture to file (limited duration)
debug tcpdump interface eth1 -w capture.pcap
# Complex filters
debug tcpdump interface eth1 "tcp port 443 and host 10.1.1.1"
# Download via web interface:
# Tools → Device Toolkit → Packet Capture → Download
Flow Analysis
1. Navigate: Analyze → Flows
2. Apply filters:
- Time range
- Site
- Application
- Source/Destination IP
- Interface
3. Review metrics:
- Bandwidth utilization
- Packet loss
- Latency
- Path selected
4. Export for offline analysis
5. Correlate with incidents
Log Collection
1. Navigate: Configuration → ION Devices → Device
2. Select Tools → Collect Logs
3. Select log types:
- System logs
- Event logs
- Debug logs
4. Download log bundle
5. Review or send to support
Remote Support Access
1. Navigate: Configuration → ION Devices → Device
2. Select Tools → Enable Remote Support
3. Generate support PIN
4. Provide PIN to Palo Alto Networks support
5. Support can remote troubleshoot
6. Disable when complete
Establishing Baselines
1. Deploy in Analytics mode initially
2. Monitor for 2-4 weeks
3. Document:
- Typical bandwidth usage per circuit
- Application mix and bandwidth
- Peak usage times
- Link quality metrics
- Number of flows/sessions
4. Use baseline for:
- Capacity planning
- SLA threshold setting
- Anomaly detection
- Policy optimization
Key Metrics to Track
Circuit Metrics:
- Bandwidth utilization (avg, 95th percentile)
- Latency (min, avg, max)
- Packet loss percentage
- Jitter
- MOS score
Application Metrics:
- Transaction success rate
- Response time
- Throughput
- Active sessions
Device Metrics:
- CPU utilization
- Memory utilization
- Flow count
- Tunnel count
- Queue drops
Start Simple, Scale Gradually
Use Network Contexts for Segmentation
Plan for High Availability
Leverage CloudBlades
Design for Scalability
Policy Management
Monitoring and Alerting
Change Management
Software Management
Security Hygiene
Documentation
Methodical Approach
Use Built-in Tools First
Engage Support Effectively
Knowledge Building
ION to Controller
ION to ION (Prisma SD-WAN VPN)
Standard VPN
Management Access
Per Device
Per Tenant
Current Releases (as of knowledge cutoff)
Upgrade Path
Dynamic Routing
Static Routing
Route Redistribution
Methods
Application Database
REST API
Python SDK
Terraform Provider
Documentation
Community
Training
Support
This skill should be referenced when:
Always consult official Palo Alto Networks documentation for the most current information, as features and capabilities evolve with each software release.