Troubleshooting practice questions

Device > High Availability > Control Link

Why it fails: The HA control link carries heartbeat and synchronisation traffic between clustered firewalls; it holds no Panorama log-forwarding credential. It is tempting because it is a Device tab location where shared secrets are configured, and it would be correct when troubleshooting HA peer authentication or cluster formation failures rather than log collection.

Device > Setup > Management > SSL/TLS Service Profile

Why it fails: An SSL/TLS Service Profile defines certificate and protocol settings for inbound management or GlobalProtect services; it does not hold the log-forwarding shared secret. It is tempting because authentication failures suggest certificate problems, and it would be correct when a service's certificate chain or TLS version is misconfigured.

Panorama > Log Collectors > Collector Group Settings

Why it fails: Collector group settings define which log collectors receive forwarded logs and how they are load-balanced; the shared secret authenticating the firewall to the collector is not stored there. It is tempting because it is the Panorama-side location for log forwarding configuration, and would be correct when assigning collectors or changing distribution policy.

Outdated WildFire signature database version on the local dataplane

Why it fails: WildFire signatures feed file and malware analysis after decryption; they do not perform TLS decryption itself. The omission is a Decryption policy with SSL Forward Proxy. Updating WildFire signatures would be correct when detection content is stale, but here no decrypted stream reaches the profiles at all.

Incorrect configuration of the Zone Protection profile on the egress interface

Why it fails: Zone Protection profiles defend against flood and reconnaissance attacks on ingress zones; they do not decrypt TLS. Decryption requires a Decryption policy with a certificate and SSL Forward Proxy configured. Zone Protection would be the right control when mitigating volumetric or scan-based attacks, not for enabling HTTPS inspection.

Failure to enable User-ID mapping for the source IP addresses

Why it fails: User-ID maps IP addresses to users for policy enforcement; it plays no part in decrypting TLS. HTTPS inspection needs a Decryption policy with SSL Forward Proxy and a trusted certificate. User-ID would be the right focus when user- or group-based rules fail to match traffic.

The SSH daemon must be configured to allow root password login.

Why it fails: API calls use HTTPS on the management interface, not SSH; enabling root password login grants shell access and weakens security without affecting API reachability. SSH access would be relevant for CLI administration or troubleshooting, whereas the API requires the management interface's permitted IP list and an administrative account with API privileges.

The firewall Data Plane interface must have user-id redistribution enabled.

Why it fails: User-ID redistribution pushes IP-to-user mappings from a firewall to Panorama or other firewalls; it does not carry API requests. API access terminates on the management plane, so the data plane interface is irrelevant. Redistribution would be correct when sharing user mappings across firewalls for policy enforcement, not for automation connectivity.

BGP routing must be enabled on the management interface to advertise API routes.

Why it fails: BGP advertises routes between autonomous systems; it does not govern API reachability on Panorama's management plane. The API listens on the management interface, so access depends on management interface permissions and allowed IP addresses. BGP would be relevant when peering Panorama with external routers for dynamic route exchange, not for enabling HTTPS API calls.

CLI command 'show system resources' on the ION device

Why it fails: 'show system resources' reports CPU, memory and process load on the ION device, not per-WAN-link path metrics such as latency, jitter and loss. It is tempting because it is a quick CLI health check, and it would be the right choice when diagnosing device resource exhaustion rather than comparing MPAA, Broadband 1 and Broadband 2 path quality.

GlobalProtect Gateway connection logs in Panorama

Why it fails: GlobalProtect Gateway logs record remote user authentication and tunnel events in Panorama, not Prisma SD-WAN path performance across MPAA, Broadband 1 and Broadband 2. It is tempting because Panorama centralises monitoring, and it would be correct when troubleshooting GlobalProtect VPN connectivity or user login failures rather than SD-WAN link latency.

Cortex XSIAM incident correlation graph

Why it fails: The Cortex XSIAM incident correlation graph aggregates and links security incidents and alerts; it holds no real-time per-link latency, jitter or loss data for MPAA, Broadband 1 and Broadband 2. It is tempting because it is a central console, and it would be correct when correlating security incidents across telemetry sources rather than diagnosing SD-WAN path quality.

Change the default gateway IP address of the core routing switch to force packet re-ordering.

Why it fails: Changing the core switch default gateway alters routing and can reorder packets, which has no bearing on how App-ID inspects and fingerprints application traffic. Gateway changes are tempting during network troubleshooting, but they are the correct action when fixing routing or path issues, not unknown-tcp classification.

Disable the Single Sign-On (SSO) agent to force all internal HTTP traffic into the default application bucket.

Why it fails: Disabling the SSO agent removes user identity context and pushes internal HTTP into the default bucket, worsening App-ID visibility rather than creating a signature. SSO agents are for mapping users to application traffic, and disabling one would be considered only when troubleshooting authentication, not application identification.

Verify that the physical firewall chassis has active power redundancy on both power supply units.

Why it fails: Power redundancy has no bearing on whether a DAG tag propagates to the firewall and matches a rule. It is tempting because hardware health checks are standard troubleshooting, and a failed PSU could cause outages. Here the API returned success, so the fault lies in tag registration, group membership, or rule configuration, not chassis power.

Ensure that the BGP routing table on the core switch is advertising the quarantined IP address.

Why it fails: BGP advertisement is irrelevant: Dynamic Address Groups are populated by Panorama tags via the User-ID or DAG API, not by routing protocols. It is tempting because network quarantine is often conflated with route manipulation, and BGP blackholing is a legitimate containment technique in routing-based scenarios, but not for DAG-driven policy enforcement.

The firewall's physical data plane interface suffered a physical cable disconnect.

Why it fails: Physical link drops affect data plane traffic, not Panorama configuration synchronization.

The firewall's SSL decryption certificate expired, causing management plane authentication failure.

Why it fails: Decryption certificates do not cause Panorama-firewall configuration sync status issues.

The syslog-ng daemon operating over UDP port 514.

Why it fails: syslog-ng forwards logs to external syslog receivers on UDP 514, not between Dedicated Log Collectors and Panorama. It would be correct when exporting logs to a third-party SIEM, but Panorama's own collector-to-manager channel uses a proprietary daemon.

The tftpd daemon transferring compressed binary logs.

Why it fails: The tftpd daemon handles configuration and software file transfers, not log forwarding between components. Log Collector to Panorama communication uses the logging daemon (logd) and the management server; tftpd is tempting because it also moves files, but not log data.

The snmpd daemon transmitting traps via UDP port 162.

Why it fails: snmpd sends SNMP traps on UDP 162 for monitoring alerts, carrying no log data. It would be the right answer if the question concerned SNMP trap delivery, but collector-to-Panorama log transport is unrelated to SNMP.

The BGP routing table on the Panorama management port for default route propagation.

Why it fails: Panorama management ports use standard static or default gateway routing, not BGP routing tables.

The firewall high availability active/passive state synchronization cable integrity.

Why it fails: HA sync cables do not impact dynamic updates or content package distribution.

Enforce strict TCP proxying for all DNS traffic passing through the firewall dataplane.

Why it fails: TCP proxying governs transport, not query content, so low-frequency tunnelling encoded in DNS payloads still passes. It suits environments forcing DNS over TCP for reliability or inspection. Detecting randomised low-rate tunnelling requires DNS-layer analytics correlating query entropy and domain reputation.

Write a custom URL Filtering category blocking all domains with more than three subdomains.

Why it fails: Subdomain count is a crude heuristic; attackers can tunnel through single-label domains, and legitimate services often use many subdomains, causing false positives. URL filtering categories suit blocking known malicious destinations, not detecting covert exfiltration encoded in query patterns.

Configure a custom Threat Prevention vulnerability signature with an extremely low threshold for UDP port 53 packet counts.

Why it fails: A low UDP port 53 packet-count threshold targets volume, which the attacker deliberately keeps low, so the signature never fires while legitimate resolvers trigger false positives. Such thresholds suit flood or high-rate abuse detection, not randomised low-frequency tunnelling that needs DNS behavioural analytics.

debug software restart process mgmtserver

Why it fails: This command restarts the management server process, which runs on the management plane and has no bearing on dataplane packet processing or per-core utilisation. It is tempting when the web interface is unresponsive, but the scenario requires dataplane diagnostics, not a management-plane service restart.

request system factory-reset

Why it fails: Factory-reset erases the configuration and reboots the firewall, destroying the running state you need to inspect and worsening the outage. It is tempting as a recovery step when a device misbehaves, but diagnosing dataplane core saturation requires show running resource-monitor or show counter global, which report per-core utilisation and drop counters.

show session all filter state active

Why it fails: Listing active sessions shows connection state and counts, not per-core CPU or packet-processing load, so it cannot identify which dataplane cores are saturated. It is tempting because session volume often correlates with load, but it is the correct choice for auditing active connections, not core utilisation.

Panorama > Managed Devices > Summary

Why it fails: Panorama > Managed Devices > Summary displays device health and connection state, offering no retention controls, so backups continue failing. It is tempting because it is the first place administrators check device status, and would be correct for verifying managed firewall connectivity rather than adjusting storage retention.

Device > Setup > Operations

Why it fails: Log and data retention settings live under Device > Setup > Management, not Operations, which only hosts configuration backup, validation and restart actions. It is tempting because Operations is where administrators manage backups, so it would be the right place to trigger or schedule a backup, not to change retention.

Panorama > Log Collectors > Collector Group

Why it fails: Panorama > Log Collectors > Collector Group configures collector group membership and log forwarding, not local retention on the Panorama appliance itself. It is tempting because log collectors store the bulk of log data, and would be correct for tuning retention on dedicated Log Collector instances.

Route all management traffic through the same vNIC as the high-throughput data traffic.

Why it fails: Sharing one vNIC between management and high-throughput data traffic lets data bursts starve management access and concentrates interrupt processing on a single interface. It tempts because consolidating interfaces reduces vNIC count and cost, and would be correct in low-throughput deployments where separate management interfaces are unnecessary.

Disable packet buffer protection globally on all firewalls.

Why it fails: Packet buffer protection exists to protect the dataplane from single-session floods; disabling it globally removes that safeguard and permits one flow to exhaust buffers, worsening drops. It tempts because buffer exhaustion appears to cause drops, and it would be correct only when a known benign flow is being wrongly throttled.

The firewall template is missing the corresponding IP subnet mask definition.

Why it fails: Template subnet masks define interface addressing, not address object references, so a missing mask cannot trigger a missing-object validation error. Template configuration matters when pushing network interface settings to firewalls, not when resolving Device Group object references.

Panorama's database replication sync service has crashed, requiring a manual MongoDB restart.

Why it fails: A crashed replication service would break commits and GUI visibility across nodes, not produce a validation error naming one specific missing reference while the object remains visible. MongoDB restarts address cluster-wide sync failures, not Device Group reference resolution.

The address object name contains uppercase letters which are disallowed by Panorama validation rules.

Why it fails: Panorama accepts uppercase characters in object names, so case cannot trigger a missing-reference validation error. The failure stems from the Device Group not receiving the object, typically because it sits in a different Device Group or is not pushed to that firewall. Uppercase naming is tempting because some platforms enforce naming conventions, but Panorama does not.

The object is defined in a template that is not associated with the target device group.

Why it fails: Templates are used for network and device configuration, not for policy objects. Policy objects such as addresses and applications are defined in device groups or shared. A template mismatch would not cause a policy validation error about a missing object. Therefore, this is not the likely cause.

The object is defined in a device group that is higher in the hierarchy but has been overridden locally on the firewall.

Why it fails: Local overrides on the firewall do not affect Panorama's validation of the configuration push. Panorama validates the configuration based on its own hierarchy before pushing to the firewall. A local override would not cause a validation error in Panorama. Therefore, this is not the cause.

The object is defined in a device group that is lower in the hierarchy than the device group being pushed.

Why it fails: Panorama policy hierarchy allows objects defined at higher levels to be inherited by lower levels. If the object is defined in a lower device group, it cannot be referenced by a higher device group because inheritance flows downward, not upward. However, the error specifically mentions a missing object, and the scenario states the object exists in the shared policy, which is at the top of the hierarchy, so this is not the cause.

Increase the TCP Three-Way Handshake timeout value in the zone protection profile to 300 seconds.

Why it fails: The handshake timeout governs how long a half-open session waits for completion; it cannot suppress out-of-window resets, which occur mid-session when the Threat Prevention engine sees sequence numbers outside the expected window. Raising it is right only when clients legitimately need longer to complete the three-way handshake.

Disable all SSL Decryption profiles globally to prevent TCP sequence number re-writing by the proxy engine.

Why it fails: Disabling SSL decryption removes inspection of encrypted SaaS traffic, but the resets stem from the Threat Prevention engine flagging TCP out-of-window anomalies caused by asymmetric routing or packet reordering, not decryption itself. Decryption profiles are correctly disabled only where legal, privacy or performance constraints forbid inspection.

Configure a static NAT policy mapping all internal RFC 1918 addresses to a single public IP.

Why it fails: Static NAT rewrites source addresses for outbound translation and has no bearing on TCP sequence validation, so out-of-window resets persist. It is the correct choice when many internal hosts must share one public address for internet egress or inbound publishing.