CCNA Prisma Access Troubleshooting Questions

When SAML group mappings expire or the identity provider session times out, Prisma Access can no longer resolve the user's groups, so policies that reference those groups stop matching even though the tunnel remains up. This produces hourly access failures with an intact session and stable address. Refreshing group mapping or extending the session lifetime restores policy matching.

Security rules in Panorama govern inter-zone traffic, so a missing trust-to-untrust rule silently drops branch egress before any NAT or routing applies. Since Remote Networks traffic traverses the trust zone toward untrust, verifying this policy directly satisfies the stem's requirement to identify why external website access fails.

Authentication succeeds because the Service Connection reaches the domain controller, but User-ID mapping requires the agent or Panorama to actively query that same controller for session data. Without polling across the Service Connection, or with User-ID traffic blocked, IP-to-username mapping never occurs for Remote Network users.

Insight path quality monitoring measures latency, jitter and packet loss across the path between remote network locations and Prisma Access nodes, giving hop-level visibility. This directly satisfies the administrator's requirement to analyse path quality for the affected region's SaaS traffic.

IKE phase 1 failures are logged as system-level events, so Monitor > Logs > System filtered for IKE or IPsec captures the precise negotiation error, such as proposal mismatch or authentication failure. Tunnel status alone shows only up/down state, not the cause.

Panorama > Cloud Services > Setup > Support exposes the Prisma Access cloud infrastructure Tech Support File generation, distinct from the managed firewall TSF. The stem specifies the cloud infrastructure scope, so this is the correct location rather than device-level support options.

The GlobalProtect app logs record tunnel state changes, including disconnects and reconnects. If the tunnel is flapping, these logs will show repeated disconnect and reconnect events with timestamps. This directly identifies tunnel instability, which matches the symptom of intermittent loss of access.

Panorama's Cloud Services status pages report per-region Prisma Access node health, capacity and infrastructure metrics for remote networks and mobile users, letting the administrator confirm whether the latency and disconnections originate from a degraded regional node.

Traffic logs in Prisma Access include the egress interface, which identifies the Service Connection used for the session. For a Remote Network, the log will show whether traffic egressed via the expected Service Connection or a suboptimal one. This directly verifies the egress point selection.

Static routes on the remote network define how traffic is forwarded from the branch to Prisma Access. If a static route for the SaaS application's subnet is missing or incorrect, traffic will not be sent to the Service Connection. The administrator should verify that the remote network's configuration includes a route pointing to the Service Connection for the SaaS application's IP addresses. This step is crucial for ensuring proper traffic flow.

Panorama > Cloud Services > Status is the dedicated workspace aggregating Prisma Access infrastructure health, showing deployed Mobile User nodes and their operational state per region. Other Panorama areas cover policy or logs, not infrastructure status.

SAML assertions carry NotBefore and NotOnOrAfter conditions. If the IdP and Prisma Access service nodes disagree on time beyond the tolerance window, Prisma Access rejects an assertion the IdP considered valid, producing exactly this split-log discrepancy.

Mobile users reach the data centre only when the Service Connection's internal subnet routes are advertised into the Mobile Users configuration. Without those routes in the Explicit Proxy or Split Tunnel settings, client traffic is never directed down the IPsec tunnel, so the tunnel being up is irrelevant.

Setting the profile to 'None' means the rule permits matching traffic but attaches no security profiles, so Antivirus, Anti-Spyware, Vulnerability Protection and WildFire inspection are all skipped. The traffic is allowed uninspected, explaining the observed bypass.

Threat Prevention cannot inspect encrypted sessions, so a decryption policy that excludes or bypasses traffic leaves it uninspected. Verifying decryption ensures traffic is actually presented to the inspection engines, satisfying the requirement to confirm inspection is not bypassed.

Explicit proxy authentication challenges and decryption profiles determine whether the proxy can complete its handshake with the client. Misconfigured profiles stall that exchange, producing timeouts, so inspecting them satisfies the stem's requirement to check areas causing connection timeout errors.

User-ID logs contain information about user identification events, including group mapping from sources like Active Directory or LDAP. These logs show which groups a user belongs to and can help diagnose why group-based policies are not matching. Reviewing User-ID logs is the correct way to verify that the user-to-group mapping is functioning as expected and that the user is associated with the correct groups.

IPsec tunnel flaps often result from mismatched IKE or IPsec crypto profiles between peers. The branch CPE and Prisma Access service connection must have identical proposal settings (encryption, authentication, DH group, lifetime). Checking both sides ensures they match. If they differ, the tunnel will fail to establish or will renegotiate frequently, causing intermittent connectivity. This is the correct component to verify.

Panorama records configuration push attempts and their failures under Job Status, with detailed errors in the Config and System logs. This satisfies the need to locate push failure details by pointing to the specific monitoring views.

A consistent 30-minute drop pattern strongly suggests a session or idle timeout mismatch on the service connection or IPSec tunnel. Checking these timers against the observed interval directly tests whether the infrastructure is tearing down idle sessions. Since tunnels and routes are confirmed up, timer expiration is the most likely explanation for periodic, predictable drops affecting multiple users.

GlobalProtect Client Settings in Panorama determine which portals, gateways and agent configurations are pushed to endpoints; misassignment prevents clients from connecting. Inspecting them satisfies the stem's requirement to check the configuration components governing mobile user connectivity.

Traffic log session details expose the App-ID Prisma Access assigned to each flow, letting the administrator compare detected application against expectation. Packet captures supplement this when the signature decision needs deeper inspection, directly satisfying the requirement to inspect live App-ID identification.

Traffic logs in Prisma Access record session details including source, destination, application, and the policy action (allow/deny). They are the primary source for determining whether a security policy is blocking traffic. Since the tunnel is up and the service IP is reachable, the next logical step is to check if sessions are being denied. Traffic logs will show the rule that matched and the reason for denial, directly answering the question.