CCNA Troubleshooting Questions

Explicit proxy authentication loops occur when the proxy intercepts the identity provider's own login traffic, so credentials are never cached. Bypassing those login pages and correcting cookie persistence in the explicit proxy profile restores the authentication flow, satisfying the stem's repeated-prompt symptom.

Checking the IKE and IPsec security associations helps confirm that the tunnel is established and that there are no mismatched parameters causing renegotiation or packet loss. If the security associations are flapping or using weak encryption, throughput can suffer. This action provides insight into the tunnel's health and stability, which are critical for performance. It is a fundamental step when troubleshooting slow throughput over an IPsec tunnel.

Custom App-IDs bind non-standard TCP ports to application signatures, so App-ID inspection recognises and permits that traffic. Without this mapping, the firewall cannot identify the application on those ports, and security rules referencing the custom App-ID will not match, causing connection failures through the Remote Network node.

DNS server addresses reach GlobalProtect clients through the agent configuration pushed from the portal. Panorama > Prisma Access > Setup > Portal > Agent > Client Settings holds the DNS split-tunnel and server settings, satisfying the requirement that internal FQDNs resolve.

'Portal unreachable' means the client cannot establish the initial HTTPS connection to the portal, which happens before authentication or tunnel setup. Because other users at the same site connect fine, the issue is likely client-specific DNS resolution or a local firewall blocking the portal port. Confirming name resolution and port reachability directly tests the first connection stage that is failing.

IPsec tunnel statistics expose packet loss, rekey failures and latency across the tunnel, while Dead Peer Detection settings reveal flapping caused by missed keepalives or mismatched timers. Since the stem describes intermittent drops and high latency across remote branches, this directly targets the site-to-site VPN path rather than unrelated policy or endpoint causes.

ACC and Traffic/Threat logs expose session volumes, application mix and attack signatures traversing the nodes. Correlating a CPU spike with a traffic surge or exploit attempt identifies whether load is legitimate volume or malicious, directly addressing the need to find the workload driving utilisation.

Threat logs record Anti-Spyware and vulnerability events with the offending packet capture, severity, threat name and session details, giving the investigator the attack specifics that traffic, URL or WildFire logs do not retain for this signature-based detection.

BGP peer state is exposed through operational CLI commands and the Prisma Access routing status view, which report the live session between the remote network and customer CPE. This directly satisfies the requirement to verify real-time route exchange rather than inferring it from configuration.

Local breakout allows mobile user traffic destined for the internet to egress directly from the Prisma Access location nearest to the user, rather than being backhauled to a service connection. If local breakout is not enabled or misconfigured, traffic may take a suboptimal path, causing latency. Verifying this feature ensures that SaaS traffic uses the best path. This directly addresses the performance issue.

Panorama > Cloud Services > Status > Remote Networks lists each remote network's IPsec tunnel state, showing whether tunnels are up or down alongside peer and gateway details. This directly satisfies the requirement to check active IPsec tunnel status for a Remote Network location without navigating device-level CLI or per-firewall dashboards.

The SSL Decryption logs provide detailed information about decryption successes and failures. If decryption is failing for the SaaS applications, the logs will show errors such as certificate issues or unsupported cipher suites. This is the most direct way to verify whether decryption is the root cause of the access issue, as it captures the actual decryption events.

Prisma Access relies on the identity provider group mapping being synchronized to the cloud service. If the user's current group is not yet reflected, the policy may match on stale membership data and apply decryption. This is a frequent cause of unexpected policy matches and should be verified in the identity mapping before changing policy logic.

Remote Network DNS queries traverse the Service Connection tunnel to reach internal DNS servers, so incorrect routing there black-holes them. Verifying this routing satisfies the stem's requirement to inspect components causing branch DNS resolution failure.

The Traffic log records each session's action and the name of the rule that matched it, so filtering for 'deny' entries reveals exactly which policy rule is dropping the legitimate traffic. This directly satisfies the stem's requirement to identify the offending rule in Prisma Access.

EICAR strings and PANW test URLs are harmless, standardised payloads that trigger antivirus and URL-filtering signatures. Sending them and confirming blocks in the Threat log verifies signatures are active without introducing real malware into the environment.

The 'openssl s_client' command initiates a TLS connection to the specified host and port, and displays the certificate chain presented by the server. This allows the administrator to verify the certificate details, such as subject, issuer, and expiration. It is a standard and effective method to inspect the certificate the portal is using for HTTPS connections.

Prisma Access remote network tunnels are subject to capacity limits determined by the location's compute resources and the licensed bandwidth. If traffic exceeds the supported throughput, packets are dropped even though the tunnel remains up. Investigating the location capacity and license tier directly addresses the intermittent drops at higher rates.

The split-tunnel DNS suffix list governs which queries GlobalProtect forwards to internal resolvers, so a missing or malformed corporate domain entry here directly explains internal-only resolution failures while external lookups succeed. Verify the DNS suffix and resolver settings under Client Config, since that configuration is pushed to mobile users and overrides local device DNS behaviour.

Traffic logs in Prisma Access Insights or Strata Logging Service contain fields such as 'Service Connection' or 'Source Service Connection' that identify the egress point for the session. Filtering by user and application will reveal the specific Service Connection in use, allowing the administrator to confirm the region and troubleshoot latency. This is the correct method to verify the actual path taken.

The HIP Match log records each HIP check result, including which host profiles passed or failed for a connecting user. Reviewing Monitor > Logs > HIP Match therefore shows exactly why the mobile user's checks are failing.

Monitor > Reports in Panorama retains aggregated historical data, including bandwidth and traffic trends, over configurable periods such as the last 30 days. This satisfies the requirement for historical reporting on a specific Remote Network location.

Mobile users reach internal corporate applications through the Service Connection, not directly through the GlobalProtect tunnel alone. With that connection reporting Down, traffic destined for internal subnets has no path, while internet-bound traffic still egresses. Restoring the Service Connection IPsec tunnel re-establishes the route to the data center and resolves the internal-only reachability failure.

The Service Connection provides the path from Prisma Access to the data center. If the Service Connection is down or the static routes for the data center subnets are missing, Prisma Access cannot forward traffic to the internal applications. Verifying the Service Connection status and its routes directly confirms whether the return path exists.

The show vpn ike-sa gateway command displays IKE phase 1 security association state and parameters for the named gateway. Running it reveals why negotiation fails, directly satisfying the need to check IPsec tunnel status and IKE SA details during phase 1 troubleshooting.

The CLI command 'show user ip-user-mapping all' lists IP-to-user mappings, confirming whether User-ID has populated entries for mobile users. Checking User-ID status in the Prisma Access monitoring dashboard corroborates this, revealing missing mappings that cause group-based security policies to fail matching traffic.

SAML assertions are signed by the IdP's private key and validated against the imported certificate. If Panorama holds a stale or mismatched signing certificate, signature validation fails and authentication is rejected, directly explaining the mobile user login failure.

QoS in Prisma Access is enforced through security policy rules, so a profile attached to the wrong rule never matches the VoIP traffic. Guaranteed bandwidth must also fit within the provisioned node's capacity; oversubscription causes the guarantee to be ignored, leaving bulk transfers competing unchecked.

Signature validation compares the SAML assertion's signature against the certificate stored in the authentication profile. If the IdP has rotated to a new signing certificate while Prisma Access still holds the old one, validation fails even though authentication at the IdP succeeded.

If the user can access internal resources by IP but not by hostname, DNS resolution is failing. The GlobalProtect portal agent configuration specifies the DNS servers pushed to clients. If the DNS server list for the user's region is incorrect or missing, the user cannot resolve internal hostnames. Verifying this configuration is the logical first step.

DPD tears down tunnels when peers disagree on interval and retry timers, because one side declares the peer dead before the other responds. Aligning these values between the customer CPE and the Prisma Access node prevents spurious teardown of an otherwise healthy IPsec tunnel.

The Cloud Services infrastructure status page exposes the running Prisma Access tenant version, since the cloud infrastructure is managed by Palo Alto rather than on-premises Panorama. This is the only location displaying the deployed cloud version.

Mobile users depend on GlobalProtect to send user-to-IP mappings to Prisma Access. Verifying that the agent reports mappings and that authentication logs show successful logins isolates whether the failure is a reporting or authentication problem, satisfying the troubleshooting requirement.

MSS clamping rewrites the TCP maximum segment size so packets fit the tunnel MTU, preventing fragmentation before it occurs. Correctly handling ICMP Destination Unreachable (fragmentation needed) lets endpoints discover the path MTU, resolving the drops.

Traffic logs record session end reasons, so timeouts, TCP resets and policy drops appear here, directly evidencing why a mobile user's connection terminates after a short period. This log therefore satisfies the stem's requirement to identify the cause of repeated drops.

Split-DNS resolution fails partially when suffix entries are malformed or the client OS search-domain limit is exceeded, so only some internal domains resolve. Correcting suffix formatting and reducing entries below the OS maximum restores resolution for the affected domains.

URL Filtering logs specifically record the URL category, the action taken (allow, block, alert), and the matched profile. This is the most direct way to confirm if a URL Filtering profile blocked the user's access. These logs are generated when a session matches a URL Filtering policy.

Inbound decryption terminates TLS at Prisma Access, which then re-encrypts to the backend using a certificate bound to the rule. If that server certificate and private key are missing or mismatched in Panorama, clients receive warnings, so verify the binding first.

For mobile users to access internal applications in a branch office, Prisma Access must have a route to that branch office network. This is typically via a Service Connection or remote network tunnel. If the Service Connection is down or routing is misconfigured, traffic will be dropped. Checking this is crucial because internet access working does not guarantee internal network reachability.

Enabling Local Internet Breakout on the Remote Network sends internet-bound traffic directly out the branch's assigned public IP rather than through headquarters. Traffic logs confirm this by showing sessions egressing via that IP, proving local breakout is functioning.

Service Connections forward traffic only for prefixes present in their routing table. Without correct static routes or BGP advertisements covering the internal subnets, Prisma Access has no matching route and falls back to the internet default path.

A mismatch in IKE or IPsec proposal parameters can allow the tunnel to negotiate initially yet fail on rekey, producing a tunnel that establishes and then drops within minutes. Verifying that encryption, hash, and Diffie-Hellman settings match on both peers directly addresses the intermittent flap. Aligned proposals ensure both phases negotiate and rekey reliably, which is essential for a stable Service Connection.

ACC aggregates application traffic by App-ID, letting you confirm whether the cloud application is being identified and permitted, or silently blocked by a security policy or decryption profile. It satisfies the need to analyse application-level behaviour for the specific unreachable app.

Config logs in Panorama record administrative configuration changes, including the administrator identity and timestamp. Reviewing Monitor > Logs > Config therefore reveals who modified the security policy during the past week, matching the audit requirement.

The CLI 'test security-policy-match' command evaluates a synthetic flow against the compiled rulebase and returns the matching rule, so it isolates whether policy logic or another factor blocks traffic. This satisfies the stem's need to verify rule evaluation for a specific source, destination and application.

Panorama's Job Status page records each configuration push task and its associated error codes. Reviewing failed tasks there exposes the specific reason a push to Prisma Access nodes did not complete, directing the administrator to the underlying misconfiguration.

Traffic logs contain fields such as 'Rule' that indicate which security policy rule was applied to a session. By filtering for the user and the session details, the administrator can see the exact rule name and whether the action was allow or deny. This directly answers the question.

The Service Connection must be enabled and properly configured with correct IPsec parameters (such as IKE and IPsec crypto profiles, and pre-shared keys) to establish tunnels. If it is disabled or misconfigured, the connection will fail. Checking these settings in the Prisma Access portal is a fundamental step to ensure the Service Connection is correctly provisioned and ready to accept or initiate tunnels.

Panorama's System and Authentication logs capture RADIUS timeout and communication errors generated by the mobile users' GlobalProtect authentication path, satisfying the requirement to locate these events centrally. System logs record daemon-level failures, while Authentication logs detail per-user RADIUS exchanges, so both must be inspected to diagnose the failing authentication.

Monitor > Logs > Threat displays threat signatures and verdicts in real time, letting the administrator filter by the specific mobile user to see why the malicious file was blocked. Other log types lack threat verdict detail.

HIP reports only reach Prisma Access if the GlobalProtect client generates and submits them at the configured intervals. Checking these settings in Panorama confirms the reporting mechanism itself is enabled, which is a prerequisite before any compliance evaluation can occur.

The GlobalProtect agent logs on the endpoint record the routes and DNS settings pushed by the gateway during connection. By examining these logs, the engineer can see if the internal subnet is included in the split-tunnel routes. If the route is missing, the client will not send traffic for that subnet through the tunnel, causing access failure. This is a direct method to verify the client's effective routing table.

Traffic logs record each session's policy match and include a Drop Reason field, letting the administrator confirm in real time whether a security rule blocked the flow. Filtering by source user and destination IP isolates the affected application traffic immediately.

URL Filtering blocks are recorded in URL Filtering logs, which show the URL category, the matched profile, and the action taken. Because mobile users succeed while remote network users fail, the difference is likely in which profile or category configuration applies to the remote network path. Filtering URL logs by those users and the destination reveals the exact category and rule causing the block.

Monitor > ACC in Panorama aggregates traffic logs into bandwidth usage, top applications, and top users, letting administrators inspect a specific Service Connection's throughput. It satisfies the requirement to monitor traffic volume and identify the heaviest consumers without manually parsing raw session logs.

Kerberos requires direct line-of-sight to a domain controller for ticket issuance, so remote GlobalProtect users off-network cannot reach internal Active Directory Domain Controllers unless a Service Connection provides routing. Without that path, ticket requests fail, producing the reported authentication prompt failures.

The Prisma Access Dashboard provides health metrics for Service Connections, including latency, jitter, and packet loss. These metrics are specifically designed to monitor the performance of the connection between Prisma Access and the remote network or internet. This is the most appropriate tool to identify if the Service Connection is causing slow access to cloud applications.

DPD detects if the peer is unreachable. If the DPD interval is too short or retry count too low, transient network issues can cause the tunnel to be torn down and re-established, leading to flapping. Increasing the DPD interval and retry count makes the tunnel more tolerant of brief disruptions, reducing unnecessary flapping. This directly addresses the suspected cause and is the correct parameter to adjust.

Panorama's Cloud Services status page surfaces live gateway health and mobile user session data for Prisma Access, showing whether each GlobalProtect gateway is responding. This directly satisfies the requirement to verify real-time gateway responsiveness to client connection requests.

Traffic logs provide detailed information about the sessions initiated by the user, including the source, destination, application, and the security policy that was applied. When a user cannot access internal resources, the traffic logs will show whether the traffic is being allowed or denied and which rule is responsible. This is the most direct way to identify the cause of the block. Reviewing traffic logs is a fundamental first step in troubleshooting access issues.

Threat and WildFire logs record whether each file was inspected, logged or bypassed. Exclusions silently skip inspection, so a malicious download may never be scanned. Reviewing these logs reveals whether an exclusion or profile misconfiguration prevented blocking.

Panorama's URL Filtering lookup tool queries the cloud URL database directly, returning the category a site belongs to and the policy rule that matches. The CLI equivalent, 'test url <website>', performs the same check, confirming why a supposedly blocked category is permitted.

The portal presents its assigned SSL/TLS certificate during the GlobalProtect handshake; an expired, mismatched or untrusted certificate triggers the client's invalid certificate error. Verifying this element satisfies the stem's constraint that the failure originates at the portal's certificate configuration.

Asymmetrical routing prevents the firewall from seeing both sides of a handshake, leading to 'incomplete' sessions.

IPsec negotiation fails outright when the two peers' IKE Phase 1 and Phase 2 proposals disagree on encryption, authentication or Diffie-Hellman group. Comparing these parameters on the CPE against the Prisma Access Remote Network node directly satisfies the stem's requirement to identify why the tunnel cannot establish.

Even if the remote network advertises the subnet, the service connection may have a BGP import policy that denies or filters the route. This would prevent the route from being installed in the routing table. Checking the import policy on the service connection is crucial to resolve the missing route.

BGP peering requires matching or correctly mapped Autonomous System numbers between Prisma Access and the customer CPE. Mismatched AS configuration causes the session to fail or routes to be rejected, directly explaining why the CPE prefixes are never learned.

The GlobalProtect app logs on the endpoint contain information about the routes that are added to the client's routing table based on the split tunnel configuration. By examining these logs, the administrator can see exactly which subnets are included or excluded, confirming whether the internal application's subnet is correctly routed through the tunnel. This is the most direct method to verify the effective split tunnel behavior on that specific user's device.

Security profiles are attached to security policy rules in the Prisma Access policy configuration. To verify that threat inspection is applied, the administrator must check the specific rule that matches the user's traffic and confirm that the appropriate security profiles (e.g., Antivirus, Anti-Spyware) are selected. Without profiles attached, traffic is allowed but not inspected. This is the direct place to validate profile attachment.

Panorama's Cloud Services licence view exposes Prisma Access subscription entitlements, including WildFire, Threat Prevention and URL Filtering, so an administrator can confirm which services are active against the tenant. This satisfies the stem's requirement to verify licence status and active subscriptions directly from Panorama.

Prisma Access uses application identification to determine the best Service Connection for SaaS traffic. If the application is recognized, Prisma Access can route it to the nearest or most optimal Service Connection, reducing latency. If it is not recognized, traffic may take a suboptimal path. Verifying that the application is correctly identified and that the Service Connection selection is optimal is key to ensuring performance.

Lowering the tunnel interface MTU or clamping TCP MSS prevents oversized packets from being fragmented across the GlobalProtect tunnel, satisfying the requirement to mitigate fragmentation for mobile users. This keeps encapsulated packets within path MTU limits.

Decryption logs specifically record sessions that were decrypted and the policy that matched. If the user's session appears in the decryption logs, it confirms that SSL decryption was applied. Absence from these logs indicates the traffic was not decrypted, which can explain why a security policy did not block or inspect it.

Traffic logs in Prisma Access record the session details including the source user, destination IP, and the egress interface or Service Connection used. Filtering by the mobile user and the internal application destination reveals whether the traffic is being routed via the Service Connection or dropped, directly answering the question.

GlobalProtect app logs on the endpoint record the DNS server settings pushed by the gateway, including the DNS servers for the tunnel and any split-DNS configuration. They can show which DNS server the client is using for specific domains, helping to diagnose intermittent resolution failures due to misconfigured split-tunnel or split-DNS settings.