CCNA Troubleshooting Questions

`show system resources` displays per-process CPU consumption on the management plane itself, directly exposing which daemon is driving the load. Unlike dataplane-focused counters, it reports the control-plane process table, satisfying the stem's requirement to identify the offending process rather than merely confirm elevated utilisation.

This command displays detailed packet and byte counters for each interface, including ingress and egress traffic. By examining these counters, the analyst can determine which interface is handling the most traffic. This directly addresses the need to pinpoint the interface contributing to the high dataplane CPU. It is the correct tool for this scenario.

The test security-policy-match command accepts a destination IP as a filter, letting you verify which policy rule would match traffic sent to a specific address. Supplying this value narrows the simulated lookup to rules whose destination criteria cover that IP.

'test security-policy-match' simulates a security policy lookup for the given source, destination, protocol, and port. It returns the matching rule name and action (allow/deny). This directly answers which policy is matching the flow, helping the analyst determine if a policy is causing the drop. It is the correct tool for this scenario.

The Application column records the App-ID signature the firewall finally matched for each session, so a suspected misidentification is confirmed by reading the actual app name there. Comparing it against expected traffic proves whether the App-ID engine classified the flow wrongly.

Layer 3 is a valid interface type, carrying an IP address and performing routing, and can be configured as a routed port or with multiple subinterfaces. This satisfies the question's requirement for genuine interface types, alongside Layer 2, virtual wire, and tap.

Packet buffer protection drops occur when ingress traffic overwhelms the firewall's per-queue buffers, typically from a flood or sustained throughput exceeding the platform's processing capacity. The firewall discards packets to protect its own resources and preserve stability.

The 'test url <url>' command allows the analyst to query the URL filtering database for a specific URL and see its assigned category. This is the most direct way to verify if the web server's URL is categorized as 'malware' or another category. If the categorization is incorrect, the analyst can adjust the URL Filtering profile accordingly to allow access.

The test security-policy-match command simulates a traffic flow against the current security policy and returns the matching rule, including whether it would be allowed or denied. It requires specifying application, source, destination, port, and protocol. This directly answers the analyst's need to identify the exact rule without committing changes.

The monitor interface command provides a real-time, continuously updating display of throughput statistics for the specified interface, including packets per second and bits per second. It is specifically designed for live monitoring and is the correct tool to determine if the sub-interface is saturated. This command shows both ingress and egress rates.

The 'show session id' command provides detailed information about a specific session, including the policy applied, the reason for discard, and other diagnostics. This is the most direct way to determine why the session is in the discard state, as it shows the exact rule or reason for the drop. It can reveal if the session was denied by a security policy, if there was a resource limit, or if another issue caused the discard.

The 'show session id <session-id>' command displays detailed information about a specific session, including the application identified, the application's characteristics, and the security policy applied. It shows the App-ID result and any related attributes, such as the application's category and subcategory. This is the most direct way to see how the firewall classified the application for that session.

Packet capture on the tunnel interface allows the administrator to see the actual encrypted packets (ESP) and, if capturing on the internal interface, the decrypted packets. By comparing the two, they can verify that encryption and decryption are occurring correctly. This is the most direct method to confirm packet flow through the VPN.

The 'test security-policy-match' command simulates a traffic flow and shows which security policy rule matches, including the rule name and action. By specifying the source, destination, port, and protocol, the administrator can see exactly which rule is denying the traffic. This directly answers the question of which policy rule is causing the denial.

The session end reason in the traffic log indicates why the session was terminated, such as policy deny, threat, or timeout. This provides immediate insight into whether the drop is due to a security policy change, an application shift, or another issue. Checking this first is efficient and non-disruptive, and it directly addresses the observed drop after initial packets were allowed.

Similar to 'show vpn ipsec-sa', this command filters the output by gateway name and still displays the Phase 2 security associations, including proxy IDs. It is useful when multiple gateways exist and the administrator needs to focus on a specific one. This command confirms whether the proxy IDs are correctly negotiated for that gateway.

SSL decryption intercepts TLS sessions, presenting a certificate signed by the organisation's internal CA rather than the site's original. If endpoints lack that CA in their trust store, browsers raise a server certificate warning. Investigating the decryption policy and its certificate chain directly addresses the warning reported for the internal site.

The 'show session id' command displays the application identified for that session, along with other details. By comparing sessions that are blocked versus allowed, the analyst can see if the application is being identified differently. This helps confirm if intermittent blocking is due to inconsistent application identification, which is a common issue in dynamic environments.

The 'show counter global filter delta yes' command displays global counters that have changed since the last poll, including packet drops. By using the delta option, the analyst can see real-time increments in drop counters, making it ideal for troubleshooting active connectivity issues. It provides a snapshot of which counters are increasing, helping to identify the cause of drops without sifting through static totals.

The Actions tab of a security rule holds the Profile Setting section, where Threat Prevention profiles are attached via a security profile group or individual profile. Inspecting this tab confirms exactly which profile governs matching traffic, rather than inferring from the profile object itself.

Sessions closing before App-ID identification produce 'incomplete' entries because the firewall never gathered enough packets to match a signature. This satisfies the stem's constraint: the Application column stays unresolved when traffic ends prematurely, so no application identity is recorded.

In many firewalls, NAT policies are evaluated in order, and if a packet matches a NAT rule that does not perform translation or matches no rule, the source IP remains unchanged. A common misconfiguration is having a NAT rule that is too specific or placed after a broader rule that denies NAT. Thus, checking the NAT policy and its order is critical.

The 'test security-policy-match' command allows the analyst to input source, destination, user, application, and service to see which security policy rule would match and what action would be taken. It is specifically designed to simulate a flow and determine policy enforcement, making it the ideal tool for this scenario. It provides the rule name and action, directly answering whether traffic is allowed or denied.

Administrative authentication events, including WebUI logins, are recorded in the System log, which captures management-plane activity such as admin logins, configuration commits and system restarts. Traffic and Threat logs cover dataplane sessions, so they would not show a management login.

IKE phase 1 negotiation requires matching pre-shared keys on both peers. If the keys do not match, the negotiation fails, and the tunnel cannot establish. This is a common misconfiguration. Checking and correcting the pre-shared key on both firewalls will resolve the phase 1 failure, allowing the tunnel to proceed to phase 2.

Traffic logs record allowed and denied sessions, including the rule that matched and the action taken. By filtering logs for the specific source and destination, the analyst can see if the firewall denied the connection and which rule was responsible. This provides historical evidence and can reveal if the traffic is being dropped by a security policy.

Threat logs are generated and stored locally on the firewall itself, satisfying the stem's requirement for on-box retention. They record security events matching threat signatures, such as viruses, spyware, and vulnerability exploits, written to the firewall's local storage rather than forwarded to Panorama or a syslog server.

The 'test security-policy-match' output includes a field that explicitly names the security rule that matched. This is the most direct way to identify which rule is responsible for the deny action, allowing the analyst to review that specific rule's configuration and determine why it is denying the traffic.

An SSL Decryption policy rule must exist and match the traffic, defining which sessions are decrypted, bypassed or blocked. Without a matching decryption rule, traffic passes through encrypted and no inspection occurs, regardless of other profile settings.

Aged-out means the session reached its configured timeout without further matching packets, so the firewall removed the entry. It indicates normal idle expiry rather than a reset, deny or application-level failure, which appear as distinct session-end reasons.

The 'show session id' command provides in-depth details for a specific session, including the reason it was discarded (e.g., policy deny, application dependency, or threat). This directly answers why the session is in the discard state. Other commands may show symptoms but not the specific discard reason tied to that session.

The test security-policy-match command output includes a 'Rule' or 'Rule Name' field that explicitly states which security policy rule matched the simulated traffic. This is the most direct way to identify the rule, as it shows the exact rule that would be applied. The analyst can then review that rule's configuration to understand why packets are being dropped or allowed.

The Decryption Log records details about SSL decryption sessions, including the decryption policy rule matched, the certificate used, and any errors such as untrusted issuer or unsupported cipher. By filtering for the user's session, the analyst can see if decryption was attempted and if it succeeded or failed. This directly verifies whether SSL decryption is working for that traffic.

Traffic logs record every connection attempt traversing the firewall, including source, destination, port and action taken. Checking them first confirms whether the user's request reached the firewall and whether a rule allowed or blocked it, directly satisfying the stem's requirement to verify traffic arrival before investigating DNS, proxy or endpoint causes.

Packet capture on the tunnel interface allows the analyst to see both encrypted (outside) and decrypted (inside) packets. By comparing them, the analyst can verify if encryption/decryption is occurring. This is a standard troubleshooting method for VPN issues. It provides direct evidence of whether traffic is being processed correctly.

Security policies are evaluated top-down, and the first matching rule is applied. If a deny rule appears before the allow rule, traffic will be denied even if a later rule would allow it. Reviewing the rule order in the interface reveals the sequence and explains why the deny rule matches first. This is the most direct way to resolve the issue.

The 'show vpn ipsec-sa detail' command provides detailed information about the IPsec security associations, including encryption and decryption packet counters, bytes, and any errors. This directly shows whether packets are being encrypted and decrypted, which is crucial when the tunnel is up but traffic is not passing. It can reveal if one direction has zero counters, indicating a problem.

The 'debug dataplane packet-diag set filter' command allows the analyst to define a filter for capturing packets on the dataplane. After setting the filter, the analyst can capture packets and then view them with 'view-pcap' or export for analysis. This provides the raw packet payload needed to inspect for sensitive data exfiltration. It is the correct tool for real-time packet inspection on PAN-OS.

The 'test security-policy-match' command allows the analyst to simulate a traffic flow by specifying source, destination, user, and application, and it returns the security policy rule that would match. This is the most direct way to see which rule is applied, including implicit rules, without generating actual traffic. It helps identify misconfigurations such as incorrect zones or addresses that cause the traffic to miss the intended rule.

The Decryption log records details about SSL decryption sessions, including errors such as unsupported cipher suites, certificate pinning, or untrusted issuer. It shows the reason for decryption failure, which is exactly what the analyst needs to diagnose intermittent failures. This log is the primary place to check when troubleshooting SSL decryption issues.

A missing or incorrect route to the remote network will cause traffic to be sent elsewhere or dropped, even if the VPN tunnel is up. The firewall must have a route pointing to the tunnel interface for the remote subnet. Verifying the routing table confirms that traffic destined for the remote network will be directed into the tunnel, which is essential for proper forwarding.

The `test security-policy-match` command reports which application the firewall identifies for a given source-destination pair, directly satisfying the 'Service' check failure. Unlike `test application` or packet-tracer utilities, it evaluates the security policy lookup itself, showing the matched rule and resolved application, so you can confirm misidentification before adjusting the policy.