Certified SD-WAN Engineer (SD-WAN-Engineer) (SD-WAN-Engineer) — Questions 76–150

Source NAT (SNAT) translates the source IP of internal traffic to the public WAN IP when traffic egresses to the internet. This hides private addresses and allows return traffic to be routed back. It is the standard method for enabling internet access for private LAN users behind a single public IP.

Policy-based forwarding allows the architect to create rules that match specific applications, such as Microsoft 365, and direct them to a local internet breakout while sending all other traffic to Prisma Access. This provides both security inspection and performance optimization for the specified application.

The BGP Neighbors tool in the orchestrator provides detailed information about BGP sessions, including the routes received from each neighbor. It shows the Adj-RIB-In, which is the set of routes advertised by the neighbor before any inbound policy is applied. This is exactly what the administrator needs to diagnose the routing loop by examining the raw advertisements.

Flow Analytics provides detailed information about each flow, including the path taken. By filtering for the specific SaaS application, the engineer can see which path was selected and whether it matches the intended policy. This directly verifies path selection decisions and helps identify if traffic is being steered incorrectly.

The Site ID is a unique identifier assigned to each site in Prisma SD-WAN. It is used to associate the site with its WAN interfaces, policies, and other configuration elements. This allows the controller to apply site-specific policies and manage the site's connectivity, making it the correct choice for uniquely identifying each site in a large deployment.

Logical tenant partitioning isolates each entity's management plane within the Prisma SD-WAN Controller, giving every tenant its own separate administrative domain, policies and visibility. This directly satisfies the multi-tenant separation requirement, preventing one entity's management traffic or configuration from being visible to, or affecting, another tenant.

The LAN interface connects the Prisma SD-WAN device to the local network, carrying traffic to and from internal hosts. WAN interfaces face the transport underlay, so the LAN interface is the correct attachment point for local LAN connectivity.

The control-plane connection to the Prisma SD-WAN controller uses TCP port 443. If the underlay is up but the control plane is down, the next logical step is to verify that the ION can reach the controller on that port and that no firewall or NAT rule is blocking it. This directly addresses the most common cause of control-plane failure.

Security Templates in Prisma SD-WAN define reusable security parameters that are applied automatically when a new gateway is onboarded, removing manual per-device configuration. This satisfies the stem's requirement for automatic configuration of security settings on new gateways.

Application Groups bundle multiple applications under one logical object, so a single steering policy covers them all. This removes per-application rule duplication and guarantees identical path selection across the group, satisfying the requirement for consistent policy application across many applications.

Lower preference ensures that traffic prefers other paths unless the DCI path is the only one remaining.

This is the specific metric to trigger the failover based on the 1% threshold.

This dashboard correlates application traffic with the transport selected and whether each path met its SLA class across a chosen window. That directly produces the per-application, time-aligned evidence the auditor requires, showing the preferred transport was used and exactly when failover to the backup occurred, without relying on inference from unrelated counters.

Essential for daily monitoring of the fabric.

A Prisma SD-WAN policy can match traffic by destination and apply different actions. By creating a rule that sends internal application traffic directly over the SD-WAN fabric and a default rule that sends other traffic to Prisma Access, the engineer meets both requirements. This provides the necessary granularity and ensures inspection only where needed.

The CloudBlade integration between Prisma SD-WAN and Prisma Access uses a shared tenant and a correlation ID to link traffic logs. When enabled, logs from both systems include this identifier, allowing administrators to correlate events. This is the required configuration to achieve the desired log correlation.

DSCP marking tags voice packets with high-priority values, and queueing schedules them ahead of bulk traffic, guaranteeing lowest latency and jitter. This satisfies the stem's requirement that branch voice traffic always receives preferential forwarding treatment across the SD-WAN fabric.

Prisma Access adds encapsulation overhead, reducing the effective MTU on the tunnel. If the ION's interface MTU is not lowered accordingly, larger packets are dropped rather than fragmented, producing intermittent failures on internal applications that exchange bulk data.

Packet loss is a measured path-quality metric: Prisma SD-WAN continuously probes WAN paths and uses loss percentages to score health and trigger path selection. It satisfies the stem's health-determination criterion alongside latency and jitter, directly reflecting degraded forwarding.

MPLS is a valid private transport type in a Prisma SD-WAN site configuration, representing a dedicated carrier circuit with committed bandwidth. It can be assigned to a site's WAN interface alongside other transports, satisfying the question's requirement for valid transport types.

The Controller dashboard aggregates telemetry from all branches and gateways, presenting fabric-wide health, link status and event summaries. This satisfies the question's focus on the primary function, giving operators a single pane for monitoring rather than per-device or per-policy configuration views.

The `show control local-properties` command displays the WAN Edge's configured organization name, VBOND, and controller IPs. If these are incorrect or mismatched, the DTLS/TLS handshake will fail and control connections will remain in 'connect' state. This is the most direct first step to validate control plane configuration before deeper troubleshooting.

A hub-and-spoke topology directs branch-to-branch traffic through the central hub, which in this design is the data center where inspection occurs. This matches the company's requirement that all branch-to-branch traffic be inspected and provides predictable, centralized control over inter-branch flows.

This real-time view for a selected WAN edge device lists the control connections to the vBond orchestrator, vSmart controllers, and vManage, including their state and system IP. It directly answers whether the device has established the expected control connections to all controller roles after onboarding.

The most direct next step is to inspect the application-aware routing policy statistics. These statistics show which path is selected for the traffic and the reason, such as which SLA class was met or if fallback occurred. This will reveal if the policy is matching the traffic correctly and if the better path is being considered. It provides actionable data to pinpoint the cause.

Prisma SD-WAN policies are evaluated in order, and the first match wins. If a higher-priority policy matches voice traffic and directs it to the internet, the voice-specific policy will never be evaluated. Policy ordering is critical; the voice policy must be placed above any broader policies that could match the same traffic.

Packet loss is a measured performance metric that Performance Routing policies continuously monitor on each path, triggering traffic steering when a threshold is breached. This satisfies the stem's requirement for criteria usable to steer traffic in a Performance Routing policy.

The Monitor > Service Connections view in Prisma SD-WAN provides real-time status of service connections, including whether they are up or down, and statistics on traffic sent and received. It is the primary dashboard for verifying connectivity and traffic flow to Prisma Access, making it the correct choice.

ION devices are the branch CPE that perform the actual data-plane forwarding, encryption, and policy enforcement. Each of the 200 branches needs an ION device to terminate the broadband circuit and participate in the SD-WAN fabric. Without a branch ION device, there is no data plane at the site, so this component is mandatory for the described deployment.

The ION device includes a packet capture utility that can be invoked from the CLI to capture packets on specific interfaces or for specific flows. This tool allows the engineer to see the actual packets, including headers and payload, to determine if packets are being dropped, modified, or delayed. It is essential for deep troubleshooting when other monitoring tools do not provide sufficient detail.

The Controller's Show tunnels view displays per-tunnel operational state, including BFD session status and uptime, for every WAN edge device in the overlay. This gives the authoritative control-plane and data-plane view needed to verify whether IPsec tunnels are up, down or flapping.

Site Groups are logical collections of sites, and policy sets are attached to the group rather than each site individually. Assigning a site to a group therefore lets one policy set apply to every member site at once, satisfying the requirement to configure multiple sites simultaneously.

Transports in Prisma SD-WAN are defined by binding them to interfaces and giving each a distinct label so policy and path selection can reference them individually. Documenting this ensures the design can distinguish the two internet circuits from the LTE link, which is essential for expressing per-transport preferences and failover rules correctly.

Packet Capture inspects actual packet headers, so it reveals the exact DSCP values the ION applies on egress. Unlike flow statistics or interface counters, which aggregate or omit per-hop marking detail, a capture satisfies the requirement to see precise DSCP markings on packets leaving the device.

Flow Monitoring correlates each flow's endpoints, so source and destination IP addresses appear alongside ports, protocol and application identification. This satisfies the question's requirement for one of the three displayed information types, letting operators trace which hosts exchanged traffic across the fabric.

The Link Quality report provides detailed real-time and historical metrics for each WAN link, including jitter, latency, and packet loss. This is the correct tool to verify if the branch's WAN link meets the required SLA for voice traffic, as it directly displays jitter measurements.

SoO tags are specifically designed to prevent loops in multi-homed BGP/OMP environments.

The Path Quality dashboard reports per-tunnel metrics for every WAN member, including reachability, latency, jitter and packet loss. Because the site has two ISPs, this view confirms whether the standby path is actually up and passing probes, rather than merely configured. It directly satisfies the requirement to verify both paths are available.

Policy-based path selection uses application SLA profiles to continuously monitor link quality (latency, jitter, packet loss) and automatically steer traffic to the best available path. When the primary broadband link degrades below the SLA threshold, the system fails over to the 4G/LTE backup without manual intervention, exactly as required for the retail branches.

VRRP allows two or more devices to share a virtual IP address and MAC address, providing a redundant default gateway for LAN hosts. If the master ION device fails, the backup takes over the virtual IP, ensuring continuous connectivity without changing host configurations.

The Tunnel Health Dashboard reports per-tunnel metrics such as latency, jitter, packet loss, and state for each WAN link in the fabric. This satisfies the stem's requirement for the most detailed view of individual tunnel health.

The Real Time flows view under a WAN edge device in vManage shows active and recent flow information, including source, destination, and the path chosen by the fabric. This is the correct place to inspect the actual forwarding decision for the specific application flow and confirm whether the policy steered it as intended.

The integration lets Prisma SD-WAN steer traffic per application while sharing telemetry with Prisma Access, delivering unified visibility and automated steering driven by security requirements. This satisfies the Direct to App policy's need to bypass backhaul without losing enforcement.

vManage records each template push as a Device Task containing the granular error returned by the device. Inspecting that log first reveals whether the failure is a CLI mismatch, connectivity issue or template variable error, avoiding guesswork before attempting any retry or rollback.

The Monitor section provides real-time and historical data on device status. Under Devices, selecting a specific ION device and then the Interfaces tab displays the status of all WAN interfaces, including up/down state, IP addresses, and throughput. This is the correct location to view interface status.

Path quality monitoring continuously measures latency, jitter, and packet loss on each WAN path. When thresholds are exceeded, the system can automatically steer traffic to a healthier path. This provides the automatic failover on degradation that the engineer requires, without manual intervention.

The Controller Status widget reports reachability between each ION device and its management controller, showing whether the control-plane tunnel is up or down. This directly satisfies the stem's request for connectivity information, distinguishing it from throughput, licence, or interface statistics that other widgets display.

Path steering policies detect link degradation and reroute traffic across the active tunnels, satisfying the HA requirement for automatic failover without manual intervention. Without them, a failed or degraded WAN path leaves the Service Connection black-holed, so steering logic is essential to maintain continuous Prisma Access connectivity.

Shaping buffers excess traffic and delays it, rather than dropping it as policing does, so egress never exceeds the provider's provisioned rate. This directly satisfies the stem's congestion-management goal by smoothing bursts to the contracted bandwidth, preventing downstream provider drops.

In Unified SASE, the ION device uses service connections to direct specific traffic to Prisma Access for security inspection. If the service connection is active but the traffic steering rules are not correctly configured, application traffic will bypass Prisma Access. The engineer must verify that the service connection includes the correct traffic selectors and that the ION device is configured to use it for the relevant applications.

Failover policy sends traffic over a single active link and switches to the standby path only when that link degrades, whereas load balancing distributes flows across multiple links simultaneously. This active/standby behaviour is the defining difference between the two policy types.

Application-aware policies inspect traffic signatures to identify Office 365 flows, then apply QoS marking and path selection without manual IP or port lists. This directly satisfies the stem's requirement to prioritise Office 365 over general web traffic, since Microsoft's constantly changing service endpoints make static ACL-based classification impractical and inefficient.

This command shows the historical status changes of the interface, including up/down transitions and timestamps. It directly provides a record of flapping events, which is exactly what the engineer needs to diagnose intermittent connectivity. It complements log analysis by giving a concise history of interface state changes.

Zero-Touch Provisioning lets an ION device authenticate to the controller and pull its configuration automatically once it has internet access. Pre-staging the device claim in the controller associates the hardware with the correct site and template. This eliminates the need for on-site IT staff and matches the requirement for automatic configuration at power-on.

Path affinity maintains flow stickiness so that return traffic traverses the same WAN interface that carried the outbound session. This preserves symmetric routing, allowing stateful inspection devices in the data center to observe both directions of each flow. It directly satisfies the stated design requirement for the dual-ISP branch.

Application Identification Settings determine how the engine classifies traffic into application categories. If steering fails, misconfigured or incomplete identification means traffic never receives the correct category, so no steering policy matches. This directly satisfies the constraint that steering depends on accurate categorisation.

This command generates a comprehensive diagnostic bundle that includes configuration, logs, and status of all subsystems. It is designed to be sent to technical support for in-depth analysis. When a device is unstable, this command captures a snapshot of the entire system state, which is invaluable for identifying the root cause of reboots and configuration loss.

App-ID classifies traffic by inspecting application signatures and behaviour, identifying applications dynamically regardless of port, protocol or encryption. This satisfies the requirement to recognise applications as they actually appear on the network, rather than relying on static port-based identification.

Source NAT translates private internal IP addresses to the public IP address of the WAN interface, allowing internal users to access the internet. This is the standard method for hiding private addresses and enabling outbound internet access. The ION device performs source NAT by default on WAN interfaces for traffic originating from the LAN, unless configured otherwise.

CloudBlades provides an API-based framework that integrates Palo Alto Networks Prisma SD-WAN with third-party and cloud services, enabling automated service insertion without appliance changes. This satisfies the architecture's requirement for extensible, API-driven service integration across branches.

Unified SASE path selection can steer traffic according to identity-based policy, so the user's department or group influences which path and security service chain the session takes. This satisfies the identity-driven factor the question requires.

Security Logs record policy evaluation decisions, including the specific rule that dropped the traffic and the reason. Reviewing them satisfies the stem's troubleshooting requirement by revealing which security policy matched and why the session was denied rather than permitted.

Unified SASE steers traffic based on application definitions and policies. Verifying that the SaaS application is correctly defined and that the steering policy matches it ensures the traffic is directed to Prisma Access. This is the first logical step to confirm whether the policy is correctly configured.

Prisma SD-WAN uses BGP as the control-plane protocol between CPEs and the Controller for dynamic route exchange. Peering BGP on the data center CPE and advertising internal subnets lets the Controller learn and distribute those prefixes to branch sites automatically, exactly matching the design requirement for dynamic route exchange and propagation.

Path quality monitoring continuously measures latency, jitter, and packet loss on each WAN circuit. When a circuit fails or degrades beyond thresholds, Prisma SD-WAN automatically reroutes traffic to the remaining healthy circuit without manual intervention. This directly satisfies the requirement for continuous monitoring and automatic failover across dual broadband links.

A direct internet breakout action in an application policy allows the ION device to forward matching traffic out of the local WAN interface without entering the SD-WAN overlay. This is exactly the behavior required for guest Wi-Fi traffic that should not consume overlay bandwidth or traverse the data center. It keeps guest traffic local to the branch.

Service Connection event logs record the tunnel negotiation, IKE/IPsec state changes and heartbeat failures between the ION device and Prisma Access nodes. This is the only log source that captures the specific reason the connection cannot establish or stay up, directly addressing the persistent 'Service Connection Down' symptom.

The Prisma SD-WAN Controller is the centralized management plane that stores the authoritative configuration, computes policy, and pushes it to ION devices. It also collects telemetry and provides the single pane of glass for the 60-clinic rollout, so it is the component responsible for maintaining configuration consistency and distributing policy fabric-wide.

Prisma SD-WAN path groups let you bind multiple WAN interfaces into a preference-ordered set, and an active-backup group sends traffic over the highest-priority healthy path, failing to the next when probes fail. Ordering MPLS ahead of internet delivers the deterministic failover the manufacturer requires without relying on per-flow load balancing or application-specific policy alone.

This command displays all active BFD sessions on the device, including the source and destination IP addresses, the negotiated hello and multiplier values, and the current state (up/down). In this scenario, it directly reveals whether the intervals match the vManage configuration and whether the sessions are actually flapping, making it the correct diagnostic step.

TLOC Preference is an OMP attribute advertised per TLOC; higher values win path selection for DCI traffic between data centres. It directly satisfies the stem's requirement by ranking transport locations before other tie-breakers such as cost or tag.

Staging on a wired network lets the device download software and validate configuration without consuming metered LTE data. Once staged and verified, it can be moved to the branch and activated on the LTE circuit. This meets both the data-conservation and validation goals efficiently.

This solution uses application identification to distinguish SaaS traffic from general internet traffic. By directing known SaaS applications to a local breakout and all remaining internet traffic through the Service Connection, it ensures Cloud SWG inspection for general web traffic while optimizing SaaS performance through direct paths, exactly matching the security team's requirements.

Latency to branch locations governs hub placement because traffic backhauls through the hub; excessive round-trip delay degrades real-time applications. It satisfies the stem's design factor by minimising overlay path delay between spokes and the regional aggregation point.

A Virtual Gateway (vGateway) is a software instance deployed in public cloud or virtualised environments, peering with Prisma SD-WAN branches over IPSec tunnels. It satisfies the stem by providing a valid fabric attachment method where no hardware CPE is present.