Verify the Bypass Rule Configuration

1. Use PACli commands on an endpoint to monitor traffic processing and confirm that bypassed traffic shows the Bypass connectivity in traffic logs.

   For example, you set up a forwarding rule to bypass the *.cnn.com destination and you want to verify the traffic from *.cnn.com is bypassed.

   1. On an endpoint, access cnn.com in a browser.
   2. In a command prompt or terminal on the endpoint, issue the following command to show the forwarding rules in a forwarding profile:

      pacli traffic show

      The following image is an example of a forwarding profile on Windows. Note the forwarding rule named cnn bypass rule.

   3. To show the details of the cnn bypass rule forwarding rule (rule 1 in the forwarding profile table), issue the following command:

      pacli traffic show 1

      The following is an example of the bypass forwarding rule:

   4. To check the traffic log for the DNS packets of *.cnn.com that got bypassed, run the following command:

      pacli traffic log | grep cnn.com

      The following is an example of the DNS packets of cnn.com that got filtered on Windows:

   5. To show the data connection for cnn.com that got bypassed:

      1. Run the curl command to transfer data from cnn.com. For example:

         curl cnn.com

      2. Grep the traffic log for the curl command:

         pacli traffic log | grep curl

         In the command output, make sure the data connection is Bypass. For example:

2. Verify that non-bypassed traffic continues to route through Prisma Access according to your other forwarding rules.

   Suppose that the traffic from the booking.com website is supposed to go through the tunnel according to your forwarding profiles configuration.

   1. Access the booking.com website on an endpoint.
   2. Issue the following command:

      pacli traffic log | grep booking.com

   3. In the command output, ensure that traffic from booking.com goes through the Tunnel. For example: