37 questions · Troubleshooting · All types, answers revealed
If an ION device is not receiving DHCP addresses from an upstream provider, where should you look first?
This is where DHCP client settings are configured.
Why this answer
The WAN interface configuration and status are the first places to verify DHCP settings.
What does the 'Flow Monitor' tool primarily track?
It tracks flow-level metrics including source, destination, and app.
Why this answer
The Flow Monitor provides granular details on active traffic sessions.
You notice an ION device is showing as 'Disconnected' in the Controller UI. What is the first step you should take?
Verifying physical and link layer connectivity is the standard starting point.
Why this answer
Verifying WAN connectivity and local interface status is the logical first step in troubleshooting connectivity.
Which THREE pieces of information are critical when opening a support ticket for a suspected SD-WAN bug?
Provides the engineering data required for analysis.
Why this answer
Technical support requires device logs, packet captures, and a clear description of the issue.
A specific branch is failing to steer traffic via the preferred ISP despite a defined Path Policy. What is the most likely cause?
If the app is misidentified, the policy engine will not apply the intended path rule.
Why this answer
Application definitions often rely on IP ranges or DSCP tags that may not match if traffic is incorrectly identified.
Which mechanism would explain why traffic is taking a sub-optimal path despite a policy favoring a different link?
Failover occurs automatically when the preferred path is deemed unhealthy.
Why this answer
If the preferred path fails the path-health check, the ION will automatically fail over to a sub-optimal path.
Which TWO factors contribute to the 'Path Health' score?
Directly impacts the health score.
Why this answer
The path health score is calculated based on packet loss and latency.
A user reports that a specific SaaS application is being blocked, but no security policy matches are seen. What is the most likely cause?
If no explicit allow rule matches, traffic is dropped by the implicit deny.
Why this answer
If no policy match is found, the traffic may be hitting the default implicit deny or is being blocked by a local device policy.
Which TWO metrics are displayed in the Path Quality dashboard?
Key indicator of path delay.
Why this answer
The dashboard displays jitter and latency as key performance indicators.
Which THREE factors can cause a site to go into 'Disconnected' state in the orchestrator?
Prevents secure tunnel establishment.
Why this answer
Loss of internet, controller reachability issues, and incorrect time settings are common causes.
Which TWO actions can resolve persistent high latency on a path?
Reduces congestion-related latency.
Why this answer
Configuring path selection policies to avoid the path or adjusting QoS settings can mitigate the impact of high latency.
You need to see the exact DSCP markings on packets exiting the ION. Which tool should you use?
Capturing packets reveals header information including DSCP.
Why this answer
A Packet Capture allows for deep packet inspection of headers like DSCP.
A site has two ISPs. Traffic is only using one. What is the best way to verify if both paths are available?
This dashboard shows current latency/loss for all paths.
Why this answer
The Path Quality dashboard displays the health status of all defined paths.
What information is provided by the 'Controller Status' widget on the dashboard?
It indicates if the management tunnel is active.
Why this answer
It confirms the connectivity status between the ION and the controller.
Which feature should you examine if traffic is not being steered based on the application category?
Ensures the traffic is correctly classified before policy application.
Why this answer
If application identification is failing, the SD-WAN policies cannot match the traffic correctly.
Which THREE logs or reports should be reviewed to troubleshoot a security policy drop?
Explicitly records security-related drops.
Why this answer
Security logs, flow reports, and session monitor are essential for tracking policy-related drops.
Where do you view the history of configuration changes pushed to an ION device?
Audit logs track all changes made in the orchestrator.
Why this answer
The audit log records all configuration modifications and administrative actions.
A branch loses connectivity to the internet, but local LAN traffic is fine. What should you troubleshoot first?
The WAN interface is the demarcation point for internet access.
Why this answer
If local traffic works, the LAN is fine. The focus should be on the WAN edge.
A branch site reports intermittent application slowness. Which tool in the Prisma SD-WAN ION dashboard is best for viewing real-time latency and jitter metrics per path?
Path Quality specifically tracks performance metrics for WAN paths.
Why this answer
The Path Quality dashboard provides real-time visibility into path performance metrics including loss, latency, and jitter.
When analyzing a PCAP from an ION device, you see 'ICMP Destination Unreachable'. Which policy is most likely causing this?
Security policies are configured to drop traffic and can return ICMP unreachable messages.
Why this answer
Security policies or access control lists (ACLs) blocking traffic will trigger ICMP unreachable messages.
Which THREE methods can be used to troubleshoot application identification issues?
Deep inspection confirms the application signature.
Why this answer
Packet captures, flow monitoring, and testing with specific traffic generators help verify identification.
Which log file on the ION device provides the most detailed information about WAN interface flapping?
System logs record interface events and link-state changes.
Why this answer
The system log contains interface status change events.
Which THREE areas of configuration should you verify if a site cannot reach the local LAN gateway?
Must be on the same subnet as the gateway.
Why this answer
Interface settings, VLAN tagging, and ARP resolution are critical for local LAN communication.
A branch is failing to load-balance traffic across two ISPs. Both are active. Which setting controls the load-balancing algorithm?
This policy determines load-balancing and path preference.
Why this answer
The Path Selection policy defines how traffic is distributed across available paths.
Which dashboard is most useful for identifying top bandwidth consumers in the network?
This dashboard breaks down traffic by application and user.
Why this answer
The App/Flow dashboard identifies top applications and users by bandwidth.
What is the function of the 'Reachability' check in the ION device configuration?
Reachability tests ensure the path can successfully reach a target.
Why this answer
It tests if the path is actually capable of reaching the destination, confirming path health.
Which TWO tools are available in the ION CLI for network connectivity testing?
Standard path analysis tool.
Why this answer
ping and traceroute are the standard tools available in the ION CLI.
A user reports slow speeds. You see that the interface is not hitting the configured throughput limit. What could be the issue?
If the ION isn't the bottleneck, the issue is likely external.
Why this answer
If the interface is not the bottleneck, the bottleneck may exist further upstream in the ISP network.
Which log is used to view denied traffic attempts?
Logs all security-related events including denied traffic.
Why this answer
Security logs capture events related to security policies, including denies.
You are debugging a routing loop. Which tool can you use to see the BGP route advertisements received by an ION device?
Route monitoring shows the learned BGP and OSPF routes.
Why this answer
The BGP neighbor status and route tables in the device monitoring show learned routes.
An ION device has experienced a configuration drift. How can you restore the last known good configuration?
The orchestrator maintains versioning for configurations.
Why this answer
The orchestrator allows for reverting to previous configuration versions.
Which TWO of these are valid ways to verify the status of an ION device's WAN interface?
Provides a graphical view of interface status.
Why this answer
Checking the UI interface dashboard and using the CLI 'show interface' command are both standard verification methods.
Which TWO items are checked by the ION device to determine if a WAN path is healthy?
High packet loss triggers a path unhealthy state.
Why this answer
The path health engine evaluates both packet loss and latency/jitter.
When troubleshooting QoS, what does a high 'drop' count in the interface statistics imply?
Drops occur when traffic exceeds the shaping rate.
Why this answer
High drop counts indicate that the interface is congested and exceeding the configured bandwidth limit.
Which THREE components are verified during the ION device 'check' sequence at startup?
Verifies physical connectivity.
Why this answer
The startup sequence checks physical links, controller reachability, and basic configuration integrity.
A user is complaining about high latency for a SaaS app. The Path Quality dashboard shows low latency. What is the next logical step?
Internal network issues are the most likely culprit if WAN paths are healthy.
Why this answer
If the WAN path is healthy, the latency might be internal to the LAN or at the application server level.
When troubleshooting a site-to-site VPN issue between two ION devices, which status should you check first?
The orchestrator provides the status of the overlay tunnels between nodes.
Why this answer
The tunnel status in the orchestrator reveals if the overlay tunnel is up.
Ready to test yourself?
Try a timed practice session using only Troubleshooting questions.