Troubleshooting practice questions

show network interface

Why it fails: This is not a valid CLI command syntax.

show chassis status

Why it fails: This is generally used for hardware components in modular chassis units.

show system status

Why it fails: This relates to the overall health of the firewall management plane.

debug ike global

Why it fails: IKE debugging is for tunnel establishment, not data plane traffic flow.

show routing route

Why it fails: This confirms route existence but not the status of the tunnel encapsulation.

ping host from tunnel interface

Why it fails: Ping only tests reachability; it does not confirm the health of the encryption/encapsulation stack.

Increase the TCP session timeout in the Application override

Why it fails: This is a mitigation step, not a troubleshooting diagnostic tool.

View the ACC tab for TCP reset trends

Why it fails: This is a visualization tool, not a diagnostic tool for packet flow.

Disable hardware offload

Why it fails: Disabling offload impacts performance and is a last resort, not a diagnostic step.

GlobalProtect Log

Why it fails: GlobalProtect logs relate to remote access sessions, not general inter-zone policy denials.

ACC (Application Command Center)

Why it fails: ACC provides a high-level overview but is not the primary tool for granular policy troubleshooting.

Packet Capture (pcap)

Why it fails: While useful for deep packet analysis, it does not directly map traffic to policy rules.

show counter interface

Why it fails: This command does not exist.

show system resources

Why it fails: Provides CPU and memory usage.

show session all

Why it fails: Shows count of sessions, not throughput.

Application

Why it fails: This identifies the application, not the address translation.

Action

Why it fails: This shows if the session was allowed or denied, not the translation.

Rule Name

Why it fails: This confirms the rule hit, but not the specific address translation result.

Transmit stage

Why it fails: This shows the packet as it leaves the firewall.

Firewall stage

Why it fails: This is not a recognized specific packet capture stage.

Receive stage

Why it fails: The receive stage captures encrypted traffic as it enters the interface.

show ha status

Why it fails: Not a valid CLI command.

show system ha

Why it fails: This is not the standard command; the correct one is 'show high-availability state'.

show system info

Why it fails: Provides general system info, not HA specifics.

show network interface

Why it fails: Shows interface settings, not protocol debugging.

show system stats

Why it fails: Not specific to DHCP processes.

Packet capture on the interface

Why it fails: While possible, 'debug dhcp' provides more actionable internal state information.

Routing table

Why it fails: While connectivity is required, checking the allowed services is the most common resolution for 'ping not working'.

NAT rules

Why it fails: NAT does not apply to management interface traffic.

Security Policy rules

Why it fails: Management interface traffic is typically handled by the management plane and does not pass through security policies.

show session info

Why it fails: show session info lists active sessions and their state, which does not expose routing tables, protocol adjacencies or forwarding decisions. It is tempting because sessions can hint at connectivity trouble, but that suits firewall or load-balancer session troubleshooting, not diagnosing why a route is missing or misdirected.

show system info

Why it fails: show system info reports platform, version and uptime details rather than routing tables, neighbours or path state, so it cannot reveal a misconfigured route or next hop. It is tempting because it confirms device health during triage, but that belongs to general system troubleshooting, not routing diagnosis.

URL Filtering Log

Why it fails: Irrelevant for DoS.

Traffic Log

Why it fails: Too verbose for DoS troubleshooting unless filtered heavily.

Data Filtering Log

Why it fails: Irrelevant for DoS.

Management UI process

Why it fails: Management plane component.

Configuration database

Why it fails: Management plane component.

Bypass

Why it fails: Not a standard action for threat logging.

Reset-both

Why it fails: An action for security profiles, but not specifically for log triggering logic here.

Allow

Why it fails: Only logs to Traffic log.

The firewall's SSL decryption license has expired.

Why it fails: An expired license would prevent the firewall from performing decryption, but typically it would not cause a reset after the TLS handshake; instead, decryption would be bypassed or blocked with a different error. The reset suggests that decryption is active but the client rejects the forged certificate. License issues usually result in a clear error message in logs.

The SSL decryption policy is not applied to the user's traffic.

Why it fails: If the SSL decryption policy were not applied, the firewall would not attempt decryption and would simply pass the encrypted traffic. The user would not experience a reset due to decryption failure. The observed reset after TLS handshake indicates that decryption is being attempted but failing, so the policy is likely applied.

The forward trust certificate is not installed on the firewall.

Why it fails: The forward trust certificate is used for decryption, but if it were missing, the firewall would not be able to decrypt at all. However, the scenario indicates that the TLS handshake completes and then the connection is reset, which suggests decryption is attempted but fails. A missing forward trust certificate would typically cause decryption to fail earlier, often with a certificate error in the browser.

show nat-policy

Why it fails: This command does not exist in PAN-OS. The correct syntax includes 'running' to specify the running configuration. Using this invalid command would result in an error and not provide the needed information, delaying troubleshooting. The analyst must use the proper command to view NAT policy details and hit counts.

show nat rules

Why it fails: This command is not supported in PAN-OS. The proper command is 'show running nat-policy'. Without the correct command, the analyst cannot view the NAT policy rules or their hit counts, making it difficult to determine if a NAT rule is misconfigured or not matching. Accurate command syntax is essential for effective troubleshooting.

show config running nat

Why it fails: This command is not valid in PAN-OS. The correct command to display the running NAT policy is 'show running nat-policy'. Using an incorrect command wastes time and does not yield the required NAT rule information. The analyst needs to see the active NAT rules and their hit counts to diagnose the issue.

Verify that the security policy allows the required application by checking the policy's application settings.

Why it fails: While verifying the policy's application settings is important, the scenario states that the traffic already matches an allow policy. The issue is likely with application identification, not policy configuration. Checking the policy would not reveal if App-ID is failing to identify the application correctly.

Run 'show counter global filter delta yes' to check for application identification errors.

Why it fails: Global counters can show drops and errors, but they do not directly indicate application identification failures for a specific session. While useful for overall system health, this command would not confirm whether App-ID correctly identified the application for this particular flow.

Use 'test application' command to simulate the application identification for the traffic.

Why it fails: There is no 'test application' command in PAN-OS. Application identification is tested through actual traffic or by viewing session details. This option is a distractor because it sounds plausible but does not exist in the CLI, so it cannot be used to validate App-ID.

Check the session details in the traffic log to see what application was identified and the applied policy.

Why it fails: While checking session details is useful, it is more of a verification step rather than a troubleshooting action to determine why misidentification occurs. The traffic log shows the identified application, but to understand why, one must examine signatures and ports. This option is less direct than the correct choices.

Restart the management plane to clear any temporary App-ID cache issues.

Why it fails: Restarting the management plane is disruptive and unlikely to resolve App-ID misidentification. App-ID operates on the data plane; the management plane handles configuration and logging. This action would not address the root cause and could cause unnecessary downtime. It is not a recommended troubleshooting step for App-ID issues.

Disable SSL decryption to see if the application is identified correctly without it.

Why it fails: Disabling SSL decryption would prevent the firewall from inspecting encrypted traffic, which could actually worsen App-ID accuracy because many applications use encryption. This action is counterproductive for troubleshooting App-ID; instead, ensuring decryption is properly configured is more relevant. Disabling decryption would not help identify the application if it is encrypted.

show profile-setting

Why it fails: The 'show profile-setting' command may not exist or may not provide the desired mapping. In Palo Alto Networks firewalls, profile settings are configured within security profiles and applied to rules. There is no single command 'show profile-setting' that shows which profiles are attached to a rule. The analyst needs a rule-centric view, making this option incorrect.

show security profiles

Why it fails: The 'show security profiles' command is not a valid command on Palo Alto Networks firewalls. Security profiles are managed through the web interface or via configuration commands. To view profiles attached to a rule, one must inspect the rule's configuration. Thus, this option is incorrect and would not yield the needed information.

show running security-policy

Why it fails: The 'show running security-policy' command displays the entire security policy configuration, but it does not specifically highlight the security profiles attached to each rule in a concise manner. It would require manual scanning. A more targeted command is needed to quickly view profiles for a specific rule, such as 'show security-policy rule' or similar, but the exact command varies. This option is not the most efficient.

test security-policy-match source 10.1.1.1 destination 192.168.1.1 port 443 protocol tcp

Why it fails: The syntax is incorrect because it uses 'port' instead of 'destination-port' and 'tcp' instead of the protocol number. The command expects 'destination-port' and a numeric protocol (6 for TCP). Using this command would result in an error or not work as intended, so it is not the correct way to test the policy match.

test security-policy-match from 10.1.1.1 to 192.168.1.1 port 443 protocol tcp

Why it fails: This command uses 'from' and 'to' instead of 'source' and 'destination', and 'port' instead of 'destination-port'. The correct keywords are 'source' and 'destination'. Also, protocol should be numeric. This syntax is invalid for the 'test security-policy-match' command, so it would not produce the desired output.

test security-policy-match source-ip 10.1.1.1 destination-ip 192.168.1.1 destination-port 443 protocol 6

Why it fails: The command uses 'source-ip' and 'destination-ip' which are not valid parameters for this command. The correct parameters are 'source' and 'destination'. While the destination-port and protocol are correct, the incorrect source and destination keywords would cause the command to fail. Therefore, this option is incorrect.