CCNA Troubleshooting Questions

The WAN interface configuration holds the DHCP client settings that request addresses from the upstream provider. If DHCP is disabled or the interface is set to static, the ION device never sends a request, so checking WAN interface settings first confirms whether the device is even asking for a lease.

Prisma SD-WAN uses policies to control path selection. A policy could be configured to direct specific traffic or all traffic over the secondary WAN interface, regardless of path quality. This is the most likely cause because policies take precedence over default path selection based on quality and cost.

The Top Applications dashboard displays applications sorted by bandwidth usage, allowing the engineer to quickly identify the top consumers. It provides a clear ranking of applications based on traffic volume, which directly answers the question of which application is using the most bandwidth. This is the most efficient way to pinpoint the culprit.

The ION device must be claimed in the Prisma SD-WAN portal using its serial number and assigned to a site for the controller to push configuration. If the serial number is incorrect or the device is unassigned, the controller will not send any configuration even though the control connection is up.

The Application Dashboard in Prisma SD-WAN Orchestrator displays real-time and historical performance metrics for applications, including latency, jitter, and packet loss. It allows administrators to quickly identify if voice traffic is experiencing degradation and whether the SD-WAN fabric is applying the correct QoS policies. This dashboard is specifically designed for application-level monitoring and troubleshooting.

Flow Monitor tracks active sessions traversing the ION, showing source, destination, application, path and byte counts per flow. It does not measure path latency or jitter, which belong to Path Quality, nor device health, so its focus is live session and traffic attribute visibility.

The 'Top Sites' widget on the orchestrator dashboard ranks sites by bandwidth consumption, allowing the administrator to quickly identify which sites are using the most bandwidth. This is the most direct way to see site-level bandwidth usage and address potential issues.

Checking physical interface status and WAN connectivity directly addresses the most likely cause of an ION device losing its management tunnel to the Controller: a down WAN link or failed physical port. Since the device cannot reach the Controller without underlay connectivity, verifying layer 1 and WAN reachability first isolates the fault before deeper troubleshooting.

The 'show interfaces' command displays detailed status for all interfaces, including WAN interfaces, showing operational state (up/down), assigned IP addresses, and packet/error counters. This directly addresses the need to check WAN link health, as counters can reveal drops or errors causing intermittent controller connectivity. It is the most direct real-time view for interface-level troubleshooting on the ION device.

Flow Analytics in Prisma SD-WAN provides detailed visibility into flows, including the policy that was applied and the path taken. By examining the specific application flow, the administrator can confirm whether the intended policy is being enforced. If the flow shows a different policy or path, it indicates a misconfiguration or shadowing, allowing the administrator to correct the policy stack or rule criteria.

Support bundles and logs capture device configuration, system state and event history at the time of the fault. Engineers need this evidence to reproduce and diagnose the suspected SD-WAN bug, making it critical when opening the ticket.

Path policies match traffic by application signature; if the application is misidentified, the flow never matches the policy and falls through to default routing, so it exits via the wrong ISP despite the policy existing.

The Event Log records significant events such as path selection changes, link up/down transitions, and policy violations. Reviewing it can reveal if the SD-WAN fabric is frequently switching paths due to link quality thresholds being crossed. This helps correlate intermittent connectivity with underlying link instability, providing valuable diagnostic context.

The ION device uses an application signature database to identify SaaS applications. If the database is outdated, the device may fail to recognize the application, causing it to be treated as unknown and potentially blocked by a default rule. Verifying and updating the signature database is essential for accurate application-based policies.

When a path fails its health thresholds, the device withdraws it from forwarding and traffic falls back to the next eligible link, even if policy prefers the failed one. This explains the sub-optimal path the stem describes without any policy misconfiguration.

Packet loss is a primary factor in the Path Health score, since dropped packets directly degrade path reliability. Alongside latency and jitter, it is measured continuously per path and weighted into the composite health calculation.

Latency is displayed in the Path Quality dashboard as a core per-path metric, measured continuously across each WAN link. It satisfies the stem's requirement, sitting alongside jitter and packet loss as the values used to judge path health.

The BGP Neighbors tool in the orchestrator provides detailed information about BGP sessions, including the routes received from each neighbor. It shows the Adj-RIB-In, which is the set of routes advertised by the neighbor before any inbound policy is applied. This is exactly what the administrator needs to diagnose the routing loop by examining the raw advertisements.

Flow Analytics provides detailed information about each flow, including the path taken. By filtering for the specific SaaS application, the engineer can see which path was selected and whether it matches the intended policy. This directly verifies path selection decisions and helps identify if traffic is being steered incorrectly.

The control-plane connection to the Prisma SD-WAN controller uses TCP port 443. If the underlay is up but the control plane is down, the next logical step is to verify that the ION can reach the controller on that port and that no firewall or NAT rule is blocking it. This directly addresses the most common cause of control-plane failure.

The ION device includes a packet capture utility that can be invoked from the CLI to capture packets on specific interfaces or for specific flows. This tool allows the engineer to see the actual packets, including headers and payload, to determine if packets are being dropped, modified, or delayed. It is essential for deep troubleshooting when other monitoring tools do not provide sufficient detail.

Packet Capture inspects actual packet headers, so it reveals the exact DSCP values the ION applies on egress. Unlike flow statistics or interface counters, which aggregate or omit per-hop marking detail, a capture satisfies the requirement to see precise DSCP markings on packets leaving the device.

The Link Quality report provides detailed real-time and historical metrics for each WAN link, including jitter, latency, and packet loss. This is the correct tool to verify if the branch's WAN link meets the required SLA for voice traffic, as it directly displays jitter measurements.

The Path Quality dashboard reports per-tunnel metrics for every WAN member, including reachability, latency, jitter and packet loss. Because the site has two ISPs, this view confirms whether the standby path is actually up and passing probes, rather than merely configured. It directly satisfies the requirement to verify both paths are available.

The Monitor section provides real-time and historical data on device status. Under Devices, selecting a specific ION device and then the Interfaces tab displays the status of all WAN interfaces, including up/down state, IP addresses, and throughput. This is the correct location to view interface status.

The Controller Status widget reports reachability between each ION device and its management controller, showing whether the control-plane tunnel is up or down. This directly satisfies the stem's request for connectivity information, distinguishing it from throughput, licence, or interface statistics that other widgets display.

This command shows the historical status changes of the interface, including up/down transitions and timestamps. It directly provides a record of flapping events, which is exactly what the engineer needs to diagnose intermittent connectivity. It complements log analysis by giving a concise history of interface state changes.

Application Identification Settings determine how the engine classifies traffic into application categories. If steering fails, misconfigured or incomplete identification means traffic never receives the correct category, so no steering policy matches. This directly satisfies the constraint that steering depends on accurate categorisation.

This command generates a comprehensive diagnostic bundle that includes configuration, logs, and status of all subsystems. It is designed to be sent to technical support for in-depth analysis. When a device is unstable, this command captures a snapshot of the entire system state, which is invaluable for identifying the root cause of reboots and configuration loss.

Security Logs record policy evaluation decisions, including the specific rule that dropped the traffic and the reason. Reviewing them satisfies the stem's troubleshooting requirement by revealing which security policy matched and why the session was denied rather than permitted.

Audit Logs record every configuration change pushed to an ION device, including who made it and when. This directly satisfies the requirement to view configuration change history, unlike operational or security logs which capture traffic and threat events rather than orchestration actions.

With LAN traffic unaffected, the fault lies at the WAN edge, so verify the ISP handoff, physical WAN interface state and IP addressing first. This isolates the boundary the stem describes: local switching works, but the uplink to the provider does not.

This command displays the routes known to the SD-WAN fabric, including those advertised by the local device and those learned from other sites. It provides a clear view of the fabric's routing table, allowing the engineer to verify whether the branch's subnet is being advertised correctly and whether data center routes are being received.

Path Quality displays real-time per-path latency, jitter and loss for each WAN circuit, directly matching the intermittent slowness investigation. Flow Monitor and event logs show sessions or alarms rather than live path performance metrics, so Path Quality isolates which link degrades.

ICMP Destination Unreachable is generated when a packet is administratively blocked, which is the action a Security Policy takes on the ION device; routing or QoS policies would drop or reclassify traffic without returning that ICMP error.

The Prisma SD-WAN Controller continuously monitors path quality, including latency, jitter, and packet loss, for each WAN link. By examining these metrics, the engineer can determine if the high latency is observed across the entire path or only on the ION device. If the controller also reports high latency, it indicates an ISP or path issue; if the controller reports normal latency, the problem may be local to the device or its measurement.

A packet capture exposes the actual traffic on the wire, letting you confirm whether the flow's payload matches a known application signature or is being misclassified. This directly satisfies the need to troubleshoot why the engine fails to identify an application correctly.

The system.log records detailed interface state transitions, including link up/down events and the underlying causes of WAN interface flapping, such as physical layer errors or keepalive timeouts. It satisfies the stem's requirement for the most detailed diagnostic information, offering greater granularity than event or alarm logs.

Verifying the interface IP address and subnet mask confirms the host's Layer 3 addressing matches the gateway's subnet. This satisfies the stem by ruling out misaddressing or an incorrect mask that would prevent the site reaching its local LAN gateway.

The Path Selection Policy defines the algorithm—such as weighted, percentage-based, or best-path—used to distribute traffic across active WAN links. With both ISPs up, this policy governs how flows are balanced, so it is the setting to inspect when load-balancing fails.

QoS configuration on the ION device determines how traffic is classified and prioritized. If VoIP traffic is not being marked or mapped to the appropriate queue, it may not receive the necessary priority, leading to jitter even if the WAN link is good. Checking the QoS configuration ensures that the traffic is correctly identified and placed in a low-latency queue, which is crucial for real-time applications like VoIP.

Application/Flow Monitoring aggregates per-application and per-flow byte counters, exposing which hosts or applications consume the most bandwidth. This directly satisfies the stem's need to rank top consumers, unlike interface-level or device-health dashboards that show only aggregate link utilisation.

Reachability actively probes the WAN interface and its upstream next-hop to confirm the ISP link is up and forwarding traffic, not merely cabled. This satisfies the stem's requirement to validate the underlying transport before overlay tunnels or policy decisions are trusted.

The Policy Browser in Prisma SD-WAN Orchestrator allows engineers to view the effective network, security, and path policies applied to a specific site or device. It shows how policies are evaluated and which rules match, including path selection based on VPN overlays. This directly helps verify if the VLAN traffic is being correctly matched and forwarded, making it the right tool for this scenario.

Licensing is required for the device to be authorized and to establish a control connection. Without a valid license, the controller will not permit the device to join the overlay network. Checking the license status ensures the device is entitled to connect and receive configuration.

Traceroute is a native ION CLI diagnostic that maps each hop along the path to a destination, exposing where packets are dropped or delayed. This directly satisfies the connectivity-testing requirement, since it verifies reachability hop by hop rather than merely confirming a single end-to-end response.

ISP-side congestion throttles traffic beyond your edge, so the interface never approaches its configured throughput limit despite the device itself performing normally. Because the bottleneck sits upstream in the provider's network, local interface counters show low utilisation, matching the stem's constraint that the configured limit is not being reached.

Security Logs capture traffic denied by firewall or security policy enforcement, including the matching rule and source. This directly satisfies the requirement to view denied traffic attempts, whereas audit logs record configuration changes and system logs record device events.

A WAN interface can show 'up' at layer 2 even if DHCP failed to provide a usable IP configuration. Without a valid IP, gateway, and DNS, the interface cannot route traffic. Checking DHCP lease details is the first logical step to confirm the interface has the necessary layer 3 parameters before investigating higher-level issues.

Route monitoring shows the learned BGP and OSPF routes.

Reverting the configuration in the Orchestrator restores the last known good configuration by pushing the previously committed template back to the ION device, directly resolving the drift. This satisfies the scenario because the Orchestrator holds the authoritative configuration baseline.

QoS policies define how traffic is classified, marked, and queued on the WAN interfaces. They ensure that voice packets receive priority treatment, such as low latency queuing and appropriate DSCP markings. Verifying the QoS policy is essential to confirm that voice traffic is prioritized correctly and to troubleshoot why it might not be.

The Firewall log records all traffic that matches firewall rules, including allow and deny actions. It provides details such as source, destination, port, and rule ID. This is the correct log to check to determine if traffic is being dropped by a firewall rule on the ION device.

The Interface dashboard in the orchestrator reports live operational state for each WAN interface, including link up/down, IP addressing and overlay tunnel health, without requiring CLI access to the device. This satisfies the stem's requirement for a valid verification method by surfacing the same telemetry the edge collects.

Packet loss directly measures dropped traffic across a WAN path, so the ION device uses it as a health metric when evaluating link quality. Alongside latency and jitter, it satisfies the stem's requirement for path-health checks, since sustained loss indicates degradation warranting failover to an alternate path.

Data plane tunnels use IPsec and can be blocked by NAT devices that do not support IPsec passthrough or by incorrect WAN IP configuration. Since the control connection (which uses TCP) is up, the issue is likely specific to IPsec. Verifying WAN IPs and NAT compatibility is the logical next step to diagnose tunnel establishment failures.

Flow Monitor in Prisma SD-WAN provides detailed visibility into individual flows, including the source, destination, application, and the WAN path being used. It also displays performance metrics such as latency and packet loss for that flow. This allows the engineer to quickly identify which path the business-critical application is using and its current performance, making it the ideal tool for this troubleshooting task.

A high drop count in interface statistics indicates the egress queue is overflowing because offered traffic exceeds the interface's configured bandwidth, which is the definition of congestion. QoS then discards excess packets rather than buffering them.

The startup check sequence verifies physical and logical link status, confirming interfaces are up and passing traffic. This satisfies the stem's requirement by ensuring the device's WAN and LAN ports are operational before the appliance proceeds to establish overlay connectivity.

This command provides detailed per-interface statistics, including input/output errors, drops, CRC errors, and queue overruns. These metrics are essential for distinguishing between physical layer issues (e.g., CRC errors) and congestion (e.g., output drops). It offers the granular data required to diagnose intermittent packet loss effectively.

The Path Quality dashboard measures WAN-side performance only, so low latency there rules out the overlay. High user-perceived latency must therefore originate LAN-side, from local congestion, faulty switching or endpoint issues, making LAN-side connectivity the next logical check.

VPN Tunnel Status in the Orchestrator shows whether the IPsec tunnel between the two ION devices is up or down, immediately confirming or eliminating the overlay as the fault domain before deeper packet-level troubleshooting. This satisfies the requirement to check status first.

WAN interface statistics can reveal physical layer issues, such as CRC errors, drops, or high utilization, which can cause intermittent connectivity. Checking these statistics on both devices helps identify if one side has a faulty link or is experiencing congestion, pointing to an underlay problem.