Troubleshooting Scenario Questions

GlobalProtect App logs on the endpoint

Why it fails: The GlobalProtect App logs on the endpoint show connection events, portal and gateway selection, and tunnel establishment, but they do not show whether internal application traffic is being forwarded through a specific Service Connection. They only confirm the client-side tunnel state, not the routing decision made by Prisma Access for internal destinations.

HIP match logs in the Prisma Access gateway

Why it fails: HIP match logs show the result of Host Information Profile checks against security policies. Since the administrator already confirmed the user's HIP profile is compliant, these logs will not reveal the routing path for internal applications. They are used for endpoint compliance, not traffic forwarding verification.

System logs on the Prisma Access portal

Why it fails: System logs capture control-plane events such as configuration commits, authentication failures, and service restarts. They do not provide per-session forwarding details for user traffic, so they cannot confirm whether a specific user's internal application flow is traversing the Service Connection.

System logs on the Prisma Access portal

Why it fails: System logs capture events such as configuration changes and service status, not client DNS server assignments. They will not show which DNS server the client is using for internal queries. Thus, they cannot help diagnose split-DNS issues on the endpoint.

HIP match logs in the Prisma Access gateway

Why it fails: HIP match logs show endpoint compliance results based on Host Information Profile checks. They do not contain DNS configuration or query details. Using them to troubleshoot DNS resolution would be ineffective because they are unrelated to DNS server selection.

Traffic logs filtered by DNS application

Why it fails: Traffic logs may show DNS sessions if they are logged, but they typically do not record the DNS server IP used by the client for a specific query. They can indicate that DNS traffic occurred, but not which server was queried or the split-DNS decision. Therefore, they are less useful for this specific issue.

Policies > NAT.

Why it fails: Policies > NAT displays network address translation rules, which carry no RADIUS authentication traffic. Authentication errors and timeouts appear under Monitor > Authentication or the user-ID agent logs; NAT is tempting because it also sits under Policies, but it handles address translation only.

Panorama > Cloud Services > Audit Log.

Why it fails: The audit log records administrative configuration changes made through Panorama and cloud services, not authentication traffic. It is tempting because it is a central troubleshooting location, but RADIUS timeout and communication errors are logged as system events, not configuration audit entries.

Monitor > Logs > Threat.

Why it fails: Threat logs record security events such as intrusion and antivirus detections, not authentication exchanges. They are tempting because failed logins can look security-related, but RADIUS timeouts and communication errors appear in the system log, which captures authentication and service daemon messages.

The Service Connection's tunnel interface is not advertising the application's subnet to Prisma Access.

Why it fails: If the Service Connection is up and the application is reachable from its tunnel interface, routing is likely fine. The Service Connection advertises routes to Prisma Access, but if it weren't, the application wouldn't be reachable from the tunnel interface. The issue is more likely policy-related.

The mobile user's DNS is not resolving the application's FQDN to the correct IP address.

Why it fails: DNS resolution issues would prevent access, but the scenario implies the application is reachable via Service Connection, suggesting IP connectivity is the focus. If DNS were the issue, it would affect all access, not just from mobile users. The most likely cause is a policy misconfiguration.

The mobile user's GlobalProtect app is not configured to include the application's subnet in the split tunnel.

Why it fails: If the application's subnet is not included in the split tunnel, traffic would bypass the VPN and not reach Prisma Access. However, the scenario states the application is reachable via Service Connection, implying it should go through Prisma Access. The issue is more likely a policy or routing problem within Prisma Access, not split tunnel exclusion.

Verify the WildFire cloud analysis subscription status.

Why it fails: WildFire cloud analysis inspects files and URLs for malware; it has no role in BGP peering or route exchange, so a subscription status cannot explain unlearned routes. It is tempting because licence and subscription checks often resolve feature failures, and WildFire subscription status would be the correct thing to verify when cloud file analysis or inline malware verdicts are unavailable.

Check the GlobalProtect portal SSL certificate expiration date.

Why it fails: GlobalProtect portal certificates secure end-user VPN authentication, not the IPSec or BGP session carrying remote network routes. It is tempting because expired certificates cause connectivity failures elsewhere, but route learning depends on tunnel, peering and prefix configuration, not portal certificate validity.

URL filtering logs

Why it fails: URL filtering logs specifically record web traffic categorization and filtering actions. They are a subset of traffic logs and may not include non-web private application traffic. They would not provide comprehensive details about security policy enforcement for all application types.

Data filtering logs

Why it fails: Data filtering logs are generated when data patterns are detected and actions are taken, such as blocking or alerting. They are not used to troubleshoot basic access control issues. They focus on data loss prevention rather than policy enforcement for connectivity.

Threat logs

Why it fails: Threat logs contain information about security threats detected by the firewall, such as viruses or spyware. They do not show policy enforcement actions for allowed or denied connections. While they are useful for security analysis, they are not the primary source for troubleshooting access control issues.

Device > Support > Tech Support File.

Why it fails: Device > Support > Tech Support File generates a TSF for the local firewall or Panorama appliance, not the Prisma Access cloud infrastructure. It is tempting because that path is the standard TSF location on Palo Alto Networks devices, and would be correct when troubleshooting the on-premises management server itself rather than the cloud service.

Monitor > Logs > System.

Why it fails: Monitor > Logs > System displays system log entries and provides no TSF generation control. It is tempting because troubleshooting naturally begins with logs, but the correct location for generating a Prisma Access cloud infrastructure TSF is the device or support section of Panorama, not the monitoring log view.

Policies > Security.

Why it fails: Security policy rules govern traffic inspection and enforcement, not diagnostic collection; no TSF generation control exists there. It is tempting because policy pages are frequently visited during troubleshooting, yet the TSF for Prisma Access cloud infrastructure is produced from the Device tab's support area instead.

The Prisma Access system logs, filtering for GlobalProtect gateway events.

Why it fails: System logs capture gateway-level events but may not provide per-user tunnel flapping details. They are more useful for configuration changes or system errors. While they might show gateway restarts, they do not offer the granular tunnel state history that the app logs provide for a specific user.

The Prisma Access dashboard's GlobalProtect status page, checking the number of connected users.

Why it fails: The dashboard shows aggregate connection counts, not individual tunnel stability. A flapping tunnel might cause the user count to fluctuate, but this tool does not provide per-user disconnect reasons or timestamps. It is too high-level to diagnose intermittent tunnel drops for a specific user.

The traffic logs, filtering for denied sessions from the mobile user's IP address.

Why it fails: Traffic logs show session allow/deny decisions, not tunnel status. Intermittent loss of all applications suggests a tunnel issue, not a policy issue. Traffic logs would only show that sessions were denied or timed out, but not why the tunnel flapped. They are not the right tool for diagnosing tunnel instability.

GlobalProtect app diagnostics tab on the endpoint.

Why it fails: GlobalProtect diagnostics show endpoint tunnel, authentication and connection state, not the firewall's policy evaluation for datacenter-bound traffic. It is tempting because it verifies client-side connectivity, and would be correct if the tunnel itself failed to establish rather than Prisma Access dropping permitted-looking sessions.

Prisma Access Insight path quality monitoring.

Why it fails: Path quality monitoring measures latency, jitter and packet loss across Prisma Access links, not security policy evaluation, so it cannot show whether a rule is dropping traffic. It is tempting because it diagnoses connectivity failures, and would be correct if the application were unreachable due to degraded tunnels rather than policy enforcement.

Panorama Dynamic Updates status page.

Why it fails: The Dynamic Updates page reports content, app and threat signature versions, not live session policy matches. It is tempting because it confirms whether security content is current, and would be correct when investigating whether outdated signatures explain unexpected allow or block behaviour.

Check the GlobalProtect gateway selection logs on the portal

Why it fails: GlobalProtect gateway selection logs pertain to mobile user connections, not Remote Network IPsec tunnels. Remote Networks do not use GlobalProtect gateway selection; they are routed based on Service Connection configuration. Therefore, these logs are irrelevant to diagnosing Remote Network egress selection.

Review the IPsec tunnel statistics on the branch firewall

Why it fails: IPsec tunnel statistics on the branch firewall show packet counts, errors, and throughput on the tunnel itself, but they do not reveal how Prisma Access internally routes traffic to a Service Connection. The branch firewall only sees the encrypted tunnel to the Prisma Access ingress, not the subsequent egress selection.

Run a traceroute from the branch firewall to the SaaS application

Why it fails: A traceroute from the branch firewall will show the path to the Prisma Access ingress, but once traffic enters the Prisma Access infrastructure, the internal routing to the Service Connection is hidden. Traceroute cannot reveal which Service Connection Prisma Access uses for egress.

Verifying the IPSec tunnel status in Panorama.

Why it fails: Panorama's IPSec tunnel status shows site-to-site VPN health between firewalls, which is unrelated to whether a remote endpoint can reach a GlobalProtect gateway. Checking tunnels is correct when diagnosing branch-to-datacentre connectivity, not client gateway discovery.

Checking the User-ID Agent logs on-premises.

Why it fails: User-ID Agent logs record IP-to-username mapping for policy enforcement, not gateway reachability, so they cannot confirm whether the GlobalProtect portal or gateway responds. This log is the right place when investigating misidentified users or missing user mappings, not connection failures.

Restarting the Cloud Identity Engine service.

Why it fails: The Cloud Identity Engine handles directory synchronisation and identity resolution, so restarting it does nothing to restore gateway reachability. That service is the correct focus when user or group attributes fail to resolve, not when clients report 'Gateway not found'.

Threat logs

Why it fails: Threat logs record security events such as intrusions, malware, and spyware detections. They are not related to user identification or group mapping. While they might show blocked traffic, they would not explain why a user cannot access internal resources due to group mapping issues. Thus, they are not appropriate for this troubleshooting step.

GlobalProtect logs

Why it fails: GlobalProtect logs primarily record connection events, such as user login, logout, and tunnel establishment. They may include the user name but do not provide details about group mapping or user ID mapping. Therefore, they are not the correct logs to verify user-to-group mapping. The administrator needs logs that specifically track user identification and group membership.

Traffic logs

Why it fails: Traffic logs show allowed and denied sessions, including source and destination, but they typically do not include group membership details. They can indicate that traffic was blocked by a policy, but to understand why, the administrator needs to check the user-to-group mapping in User-ID logs. Traffic logs alone would not reveal if the user is missing from a required group.

Enable SSL Decryption on the Service Connection interface.

Why it fails: SSL decryption inspects encrypted traffic traversing the Service Connection; it does not advertise remote network subnets into the data centre routing domain. It is tempting because decryption is a common Prisma Access security requirement, and would be correct when policy must inspect TLS traffic from branch users.

Create a GlobalProtect Portal authentication profile for the data center.

Why it fails: A GlobalProtect Portal authentication profile governs user login and endpoint posture, not subnet advertisement between Prisma Access and the data centre. It is tempting because GlobalProtect is central to remote-user connectivity, and would be the right configuration when onboarding new user populations or changing authentication methods.

Configure Zone Protection profiles on the tunnel interface.

Why it fails: Zone Protection profiles defend against flood and reconnaissance attacks on a zone; they do not exchange routing information with the data centre. It is tempting because zone protection is standard hardening on tunnel interfaces, and would be correct when mitigating volumetric attacks rather than resolving missing subnet advertisement.

Change the mobile user authentication type from SAML to RADIUS.

Why it fails: Authentication type determines how users prove identity to the portal or gateway, not how packets are sized or fragmented. Switching SAML to RADIUS would be the right action when identity provider integration fails. MTU drops instead call for checking tunnel interface MTU and TCP MSS adjustment settings.

Configure a WildFire analysis profile to bypass large files.

Why it fails: WildFire profiles submit files for sandbox analysis and cannot alter packet size or fragmentation behaviour. Bypassing large files would matter when sandbox inspection delays or blocks transfers. MTU-related drops instead require verifying tunnel MTU and TCP MSS clamping so oversized packets are fragmented or rejected correctly.

Increase the GlobalProtect client idle timeout value to 3600 seconds.

Why it fails: GlobalProtect idle timeout governs how long an inactive tunnel session persists; it has no bearing on packet size or fragmentation. Adjusting it would be relevant when sessions drop prematurely. MTU mismatches instead require verifying tunnel MTU and TCP MSS clamping values on the path.

Traffic matching the rule is dropped automatically.

Why it fails: A profile setting of 'None' means no Security Profile Group or decryption is applied, so matching traffic is allowed without inspection rather than dropped. Dropping is tempting because deny rules exist, but that requires an explicit deny action, not an empty profile.

SSL decryption is automatically enabled.

Why it fails: 'None' leaves traffic uninspected; SSL decryption is a separate policy action that must be explicitly configured. Decryption is tempting because it also concerns inspection, but it is a distinct setting, and an empty profile never enables it automatically.

Traffic is forced through the explicit proxy.

Why it fails: 'None' applies no security profile to matching traffic; it does not route traffic through an explicit proxy. Explicit proxy is tempting because Prisma Access supports proxy-based forwarding, but that is configured separately, not triggered by an empty profile setting.