Troubleshooting practice questions

show ip route

Why it fails: This shows the routing table but not the controller tunnel status.

show controller status

Why it fails: This command does not exist in the ION CLI.

debug mgmt-tunnel

Why it fails: This is not a standard command for checking connectivity state.

Packet Capture

Why it fails: Captures raw traffic but does not show path analysis.

Flow Monitor

Why it fails: Flow Monitor shows traffic volume, not path forwarding logic.

Path Selection Rules

Why it fails: These are policies, not diagnostic tools.

show interface status

Why it fails: Only shows physical/logical interface status.

show route

Why it fails: Displays the routing table.

show perf

Why it fails: This is not a valid command.

Memory exhaustion

Why it fails: Would cause general instability, not specific blockages.

Encryption mismatch

Why it fails: Would show as a handshake failure, not a blocked policy.

BGP path selection error

Why it fails: BGP doesn't block traffic, it only routes it.

High CPU load

Why it fails: High CPU load degrades throughput and can delay forwarding, yet the control-plane tunnel to the orchestrator persists, so the site stays Connected. CPU load is the correct factor when diagnosing performance degradation or packet loss on a site that remains reachable.

Local VLAN misconfiguration

Why it fails: A local VLAN misconfiguration affects data-plane forwarding at the branch, but the orchestrator still receives control-plane heartbeats, so the site remains Connected. VLAN configuration is the correct focus when troubleshooting traffic forwarding or routing issues at a site that is otherwise online.

Delete all VLANs

Why it fails: Disruptive and unrelated.

Change the device hostname

Why it fails: Irrelevant to latency.

Increase the MTU size

Why it fails: Rarely impacts latency directly.

show control-plane status

Why it fails: This command would display control plane status, but the scenario already states that the control plane is up. It does not provide data plane tunnel information. Using this command would not help diagnose the lack of application traffic because the issue is with data plane tunnels, not the control plane.

show data-plane tunnels

Why it fails: This command is not valid on the ION device. While it seems logical, the correct command is 'show tunnel interface'. Attempting an invalid command will not yield useful output and may lead to confusion. It is important to use the exact command syntax supported by the device to troubleshoot effectively.

show tunnel status

Why it fails: This command is not valid on the ION device. While it sounds plausible, the correct command to check data plane tunnels is 'show tunnel interface' or 'show tunnel summary'. Using an invalid command will return an error and waste troubleshooting time, delaying resolution of the actual data plane issue.

Ensure that the ION devices are licensed for SD-WAN and have valid certificates.

Why it fails: Licensing and certificates are required for the ION devices to communicate with the Prisma SD-WAN controller, but they do not directly affect IPsec tunnel establishment between devices. Once the devices are operational and connected to the controller, they can form tunnels regardless of licensing. This is not the primary cause of tunnel failure.

Review the firewall rules on the ION device to see if they are blocking IPsec traffic.

Why it fails: Firewall rules on the ION device typically apply to traffic traversing the tunnel, not to the IPsec negotiation itself. IPsec negotiation uses UDP ports 500 and 4500, which are usually allowed by default. While a firewall could block these, it is less likely than a misconfiguration in the IPsec parameters. The administrator should first check the IPsec settings.

Check the BGP configuration to ensure that route advertisements are being exchanged.

Why it fails: BGP is used for route exchange over an established tunnel. If the IPsec tunnel is not up, BGP cannot form a session. Therefore, checking BGP is premature; the tunnel must be established first. The issue is at the IPsec layer, not the routing layer.

show controller status

Why it fails: The 'show controller status' command is not a valid command on ION devices. It might be confused with orchestrator dashboard widgets, but on the CLI, the correct command to check tunnel status is 'show tunnel status'. Using an invalid command wastes time during troubleshooting.

show system status

Why it fails: The 'show system status' command provides general system health information such as uptime, CPU, and memory, but it does not specifically display the status of the management tunnel to the Prisma SD-WAN Controller. To verify tunnel status, a more targeted command is required.

show interface brief

Why it fails: The 'show interface brief' command lists all interfaces with their IP addresses and link status, but it does not provide information about tunnel states. While it can confirm that the WAN interface is up, it does not help diagnose management tunnel connectivity issues.

show interface brief

Why it fails: This command lists interface statuses and IP addresses, which is useful for verifying physical and logical interface connectivity. However, it does not reveal the state of the control plane tunnel to the Prisma SD-WAN Controller or any authentication errors, making it insufficient for this specific troubleshooting scenario.

show system status

Why it fails: This command gives an overview of the device's hardware and software health, such as CPU, memory, and disk usage. It does not show the status of the control plane tunnel to the controller or authentication state, so it would not help diagnose why the control connection is failing.

show tunnel status

Why it fails: This command displays the status of data plane tunnels used for traffic forwarding, not the control plane connection to the controller. While it shows tunnel up/down states, it does not provide authentication details or the control plane tunnel status, which are critical for diagnosing why the ION cannot register with the controller.

show bgp summary

Why it fails: While 'show bgp summary' provides an overview of BGP neighbor states and prefix counts, it does not show the actual routes received. It would indicate if the BGP session is established and how many prefixes are received, but not the specific routes. This command is useful for a quick check but insufficient to verify route details.

show route bgp

Why it fails: 'show route bgp' displays the BGP routes in the routing table, but it does not show which neighbor advertised them or the full BGP attributes. While it can confirm if routes are installed, it lacks the neighbor-specific detail needed to troubleshoot why routes are not being received from a particular neighbor.

show ip bgp neighbors <neighbor-ip> routes

Why it fails: This command is not valid on the ION device. The correct syntax to view routes received from a specific neighbor is 'show bgp neighbor <neighbor-ip> routes'. Using incorrect syntax will result in an error. It is crucial to use the correct command to avoid unnecessary delays in troubleshooting.

Run the CLI command 'show ipsec dpd' on the ION device.

Why it fails: The command 'show ipsec dpd' is not a valid command on ION devices. Prisma SD-WAN uses a proprietary CLI, and IPsec DPD settings are not exposed via that specific command. The administrator would need to use the correct diagnostic commands or the orchestrator interface to view DPD-related information.

Check the ION device's local syslog for DPD messages.

Why it fails: While syslog may contain some IPsec events, DPD configuration and detailed statistics are not typically logged there. The orchestrator provides a more direct and real-time view of DPD status. Relying on syslog alone would be inefficient and might miss critical DPD-related data needed for troubleshooting.

Use the 'debug ipsec' command on the ION device to enable DPD logging.

Why it fails: The 'debug ipsec' command is not available on ION devices. Prisma SD-WAN uses a different debugging framework, and enabling DPD logging is not done via that command. The orchestrator is the correct place to view DPD statistics without impacting device performance.

show security certificate

Why it fails: This command is not valid for checking device certificate status on an ION device. It might be confused with security-related certificate commands, but it does not provide the necessary information about the device's identity certificate used for fabric authentication. The engineer should use the correct command to view the device certificate.

show system certificate

Why it fails: This command displays general system certificate information but does not specifically show the status of the device certificate used for fabric tunnel authentication. It may list certificates stored on the device but lacks the detailed validation state needed to confirm if the certificate is properly enrolled and trusted by the controller.

show controller certificate

Why it fails: This command is not a valid ION CLI command. While it sounds plausible, it would not return any useful output. The engineer needs a command that specifically checks the device's own certificate status, not a controller certificate, which is not how the ION CLI is structured.

show ip route

Why it fails: The 'show ip route' command displays the IP routing table, including routes learned via BGP, but it does not show BGP neighbor status or peering details. While it can confirm if routes are present, it does not indicate whether BGP sessions are established or which neighbors are advertising routes, making it insufficient for troubleshooting BGP peering issues.

show routing protocol bgp

Why it fails: This command is not a valid CLI command on ION devices. The correct syntax for BGP troubleshooting typically uses 'show bgp' followed by subcommands. Using an invalid command would result in an error and not provide the needed information. Therefore, it is not the right choice for verifying BGP peering status and routes.

show bgp neighbors

Why it fails: The 'show bgp neighbors' command provides detailed information about BGP neighbors, including timers and capabilities, but it may not be available on all ION device software versions or may require additional parameters. The 'show bgp summary' is more universally supported and provides a concise overview of neighbor status and route counts, making it the better choice for a quick verification.

ping <controller-hostname>

Why it fails: The ping command can test reachability and will attempt DNS resolution, but it does not provide detailed DNS query information. If DNS fails, ping will report an unknown host error, but it does not show which DNS server was queried or the response. A dedicated DNS lookup tool is more informative for troubleshooting DNS issues.

show dns cache

Why it fails: The 'show dns cache' command displays cached DNS entries, which can be useful but does not actively query DNS servers. If the cache is empty or stale, it won't help verify current DNS resolution. An active query tool like nslookup is needed to test resolution in real time.

traceroute <controller-hostname>

Why it fails: traceroute traces the network path to a destination and can also perform DNS resolution, but its primary purpose is to identify routing hops. It does not provide detailed DNS query information. While it can show if DNS resolution fails, it is not the best tool for isolating DNS issues.

show route table

Why it fails: The 'show route table' command shows the overall routing table, which includes routes from all sources, not just BGP. While it can indicate a loop, it does not specifically show BGP-learned routes or their attributes, making it less useful for diagnosing BGP-specific issues.

show ip bgp summary

Why it fails: The 'show ip bgp summary' command, if available, typically provides a summary of BGP neighbor states and prefix counts, but not the detailed routes themselves. It is useful for a quick health check but insufficient for analyzing received routes in detail.

show bgp neighbors

Why it fails: The 'show bgp neighbors' command provides information about BGP neighbor relationships, such as peer addresses and session states, but it does not display the actual routes received. To see received routes, a different command is needed that shows the BGP table.

The ION device's WAN interface is administratively down.

Why it fails: If the WAN interface were administratively down, the ION device would not have an active route to the BGP peer, and the peer would likely be in Idle state, not Active. Additionally, other traffic would be affected. An administratively down interface is typically logged and visible via 'show interfaces', so it is less likely to be the specific cause here.

The BGP keepalive timer is set too high on the ION device.

Why it fails: Keepalive timers affect session maintenance after the session is established, not the initial TCP handshake. If the timers are mismatched, the session might flap after establishment, but the peer would not remain stuck in Active state. High keepalive timers do not prevent the TCP connection from being established, so this is not the primary cause.

The ION device is configured with an incorrect BGP router ID.

Why it fails: While a router ID is important for BGP, an incorrect router ID typically causes issues with route selection or session establishment only if it conflicts with another router. It does not usually prevent the TCP session from being established. The peer would still attempt to connect; thus, an incorrect router ID is unlikely to cause the peer to remain in Active state.

DPD timeout

Why it fails: The DPD timeout is the duration to wait for a DPD response before considering the probe missed. While increasing the timeout can help, it is not the parameter that controls the number of missed probes. The retry count is more directly related to tolerance of delays because it allows multiple missed probes.

DPD mode

Why it fails: DPD mode typically refers to on-demand or periodic DPD. Changing the mode might affect when DPD is triggered but does not directly control the tolerance to temporary delays. The retry count is the specific parameter that determines how many missed probes are allowed before declaring the peer dead.

DPD interval

Why it fails: The DPD interval controls how often DPD probes are sent. Increasing the interval might reduce the frequency of probes but does not directly affect tolerance to delays; it could actually delay detection of a dead peer. Adjusting the interval alone is not the primary parameter to increase tolerance.

Check that the WAN interfaces on both devices have public IP addresses and can reach each other on UDP port 4500.

Why it fails: While ION devices use IPsec for secure Fabric connections, they typically use NAT-Traversal on UDP port 4500 if behind NAT. However, they do not require public IP addresses; they can be behind NAT and still form connections. The key is that they can reach the controller and each other via the Fabric, often using the controller for signaling. This step is not the most direct troubleshooting action.

Confirm that both devices are using the same IKEv2 pre-shared key for the Fabric tunnel.

Why it fails: In Prisma SD-WAN, Fabric tunnels are established automatically using certificates and the controller for key exchange. There is no manual pre-shared key configuration for Fabric tunnels. The devices use their unique certificates to authenticate with each other via the controller. Therefore, checking for a pre-shared key is not applicable.

Verify that the branch ION device has a static route pointing to the data center ION device's public IP address.

Why it fails: Prisma SD-WAN uses dynamic routing and the controller to establish Fabric tunnels. Static routes are not required for Fabric connectivity; the overlay network handles routing automatically. Adding static routes could interfere with the dynamic routing protocols used by the Fabric. Thus, this step is unnecessary and potentially harmful.

The LAN interface is configured as a DHCP client instead of a DHCP server.

Why it fails: If the LAN interface were configured as a DHCP client, the ION device would be trying to obtain an IP address for itself, not serving addresses to LAN devices. However, the issue is that the ION device is not receiving an IP address from an external DHCP server, meaning the ION device itself is acting as a DHCP client on that interface. So this is actually the expected configuration if the ION device is to obtain an address from the LAN DHCP server.

The LAN interface is configured with a static IP address that conflicts with the DHCP server's scope.

Why it fails: If the ION device's LAN interface had a static IP conflicting with the DHCP scope, it could cause IP conflicts, but the issue is that the ION device is not receiving an IP address, not that it has one. A conflict would typically result in the ION device having an address but with connectivity issues, not failing to obtain one. Thus, this is not the most likely cause.

The ION device's WAN interface is down, preventing it from reaching the DHCP server on the LAN.

Why it fails: The WAN interface being down would affect internet connectivity, but the DHCP server is on the LAN side. The ION device would use its LAN interface to reach the DHCP server, not the WAN interface. Therefore, a down WAN interface would not prevent the ION device from obtaining a LAN IP address via DHCP.