Diagnose Multi-Cloud Network Connectivity and Security Policy Issues using Cloud Tracer

Table of Contents

Basics of Container Security Using Prisma AIRS Runtime Security

Diagnose Multi-Cloud Network Connectivity and Security Policy Issues using Cloud Tracer

Learn how to use Cloud Tracer for tracing and debugging network paths.

Where Can I Use This?	What Do I Need?
Prisma AIRS AI Runtime Security	Onboard and Activate a Cloud Account in Strata Cloud Manager

You can diagnose multi-cloud network connectivity and security policy issues using Cloud Tracer. Cloud Tracer delivers real-time insights into network traffic paths and security policy enforcement within your cloud environments. It enables you to trace packet routes and diagnose connectivity issues.

The Cloud Tracer Service deploys and configures tracer parameters across your environment. You define trace parameters via the Visualization/Reporting Interface, which translates requests into actionable trace jobs. Agents then generate specialized trace packets, collecting hop-by-hop information. This system uses a distributed agent-based model with a centralized control plane, integrating with native cloud capabilities.

Tracer Agents establish secure, outbound connections to the Cloud Tracer Service to report telemetry. The Service communicates with the Data Store/Analytics Engine for persistent storage and analysis. This architecture provides granular, per-segment network visibility, and offers near real-time insights for issue resolution in your network.

With this release, Cloud Tracer supports:

Azure and cross-cloud AWS-to-Azure tracing
Full inline Palo Alto Networks firewall policy evaluation at the firewall hop
Broader security policy coverage including security groups, network access control lists (NACLs), and network security groups (NSGs) evaluated at every applicable hop along the path

Cloud Tracer always shows the full end-to-end path as long as a route exists. Even if a security policy denies traffic at a hop, the trace continues to show every hop that would have been traversed.

The trace may fail when a route is missing; a full, end-to-end trace occurs as long as the route exists.

The hop where traffic was denied is clearly marked with a drop indicator and the specific reason—whether it is a firewall policy name, a NACL rule number, or an NSG rule—so you know not just that traffic was blocked, but exactly where and why.

This procedure guides administrators through deploying, configuring, and validating the Cloud Tracer feature within your environment.

Log in to Strata Cloud Manager.
Select Insights > Cloud Network Security > Cloud Tracer. What you see depends on whether any traces were previously run on this tenant:
- If no traces have been run, you land on a zero-state page with a prompt to get started.
- If traces have been run before, you land directly on the Trace History page.
Start a new trace.
Start a trace. There are two ways to start a new trace: Click Run Trace to get started.
1. Click Run Trace to get started.
2. From within an existing trace result, click Show Parameters, update the fields as needed, and click Run Trace.
In the Trace Parameters screen, enter the following information:
1. In the Source section, specify the Cloud Provider and use the drop-down to select the corresponding Region, select the VPC/VNet and indicate the IP address, then enter the Source Port and optionally select the Protocol (for example, TCP, UDP, or ICMP).
2. In the Destination section, use the drop-down to select the Region, choose the VPC/VNet and indicate the IP address, then enter the Destination Port.
Enter a descriptive Trace Name. This name helps identify the Cloud Tracer deployment for auditing and management. The field accepts alphanumeric characters and hyphens.
Click Run.

Validate Cloud Tracer Installation and Operation

Use this procedure to validate Cloud Tracer operation:

Navigate to Cloud Tracer > Status. This page provides an overview of deployed Cloud Tracer instances and their operational status.
Verify the Status column for your Cloud Tracer instance shows Running. A Running status confirms successful deployment and active monitoring. Investigate any other status, such as Pending or Error.
Perform a test trace to confirm active data collection:
1. Select your deployed Cloud Tracer instance.
2. Select Run Test Trace.
3. Enter the Test Source IP (e.g., 192.168.1.15).
4. Enter the Test Destination IP (e.g., 10.0.0.10).
5. Select Initiate Trace.
Review the initial trace results to confirm data visibility.
Observe the Trace Path visualization, noting hops and devices.
Check the Latency and Packet Loss metrics.
Confirm trace data aligns with your network topology and expected traffic flow.

When you open a trace result, the summary at the top shows the overall status, how many paths were traced, and how long it took. The main view is a hop-by-hop visual diagram.

Click any hop to open its details panel. Each hop includes a transition description—a plain-English explanation of exactly how the packet traversed that hop, including which interface was selected, which IP was used, which subnet it was forwarded to, and the matched rule that drove the decision.

You will often see multiple paths in a trace. This reflects the inherent redundancy of real cloud topologies—traffic can flow through multiple availability zones, multiple firewall instances behind a load balancer, or multiple ECMP routes in a transit gateway. Cloud Tracer traces all of these simultaneously so you see the complete picture.
Manage traces from the Trace History page. This page shows all previously run traces. For each trace, you can see the trace name, run status, source and destination region, IPs, cloud provider, ports, and the last run timestamp:
- Filter traces by typing in the filter box—it searches across all fields.
- Click a trace name to open the results of its last run.
- From within a trace result, click Show Parameters to reveal the inputs used, then re-run with the same parameters or modify any field and click Run Trace.
- Delete a trace from this page.