>
    Strata Copilot
    Diagnose Multi-Cloud Network Connectivity and Security Policy Issues
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma AIRS
    3. AI Runtime Security
    4. AI Runtime Security VM Firewall
    5. Cloud Tracer
    6. Diagnose Multi-Cloud Network Connectivity and Security Policy Issues
    Download PDF
    Prisma AIRS

    Diagnose Multi-Cloud Network Connectivity and Security Policy Issues

    Table of Contents

    Diagnose Multi-Cloud Network Connectivity and Security Policy Issues

    Cloud Tracer is an automated network path analysis tool that bridges network operations and security by simulating hop-by-hop traffic flows across AWS and Azure environments. Without sending live probe traffic, it evaluates route tables, NAT configurations, cloud-native security groups, and firewall policies.
    Where Can I Use This?What Do I Need?
    • Prisma AIRS AI Runtime Security
    Cloud Tracer provides end-to-end routing and security path analysis across your cloud (AWS, Azure) infrastructure. It simulates and visualizes traffic flows without sending active probe packets, helping you pinpoint routing misconfigurations, missing security group rules, or blocked firewall policies.
    Cloud Tracer supports two primary directional tracing workflows:
    • App to App (East-West): Traces traffic flows between internal workload endpoints across VPCs/VNets, accounts, regions, or multi-cloud environments (AWS, Azure).
    • App to Internet (North-South Egress) — AWS only: Traces outbound egress flows initiated by internal workloads heading to public internet destinations.
    Cloud Tracer automatically evaluates newly deployed firewalls during automated deployment workflows. It validates that traffic routing through Gateway Load Balancers (GWLB), Transit Gateways (TGW), and Policy-Based Routing (PBR) properly reaches the firewall, and verifies that firewall policy enforcement (Allow/Drop) functions as expected across East-West and North-South egress topologies.
    Supported Egress Topologies (AWS)
    For App to Internet egress traces, Cloud Tracer automatically evaluates three standard architectural patterns:
    Egress TopologyPath SequenceHop Behavior & Boundary
    All ProtectedApp VPC → VPC Endpoint (GWLBE) → Security VPC → Internet Gateway (IGW) → InternetEvaluates the VPC Endpoint, GWLB, and firewall policies up to the IGW. The path terminates at the non-clickable Internet node, representing the public internet edge.
    Outbound OnlyApp VPC → Transit Gateway (TGW) → Security VPC → Firewall → Internet Gateway (IGW) → InternetEvaluates Transit Gateway route tables, attachments, Security VPC routing, and firewall policy rules through the IGW to the Internet node.
    All Protected + GatewayApp VPC → VPC Endpoint (GWLBE) → GWLB → Security VPC → AWS NAT Gateway → Internet Gateway (IGW) → InternetEvaluates GWLB Endpoints, firewall security policies in the Security VPC, AWS NAT Gateway interfaces (SNAT), and IGW routes out to the Internet node.
    For App to Internet egress traces, Cloud Tracer automatically evaluates three standard architectural patterns:
    • App to Internet tracing is currently supported for AWS infrastructure only. Azure and GCP egress tracing are not supported.
    • Destination Address Requirement: When App to Internet is selected, the destination address must be a public IP address or valid internet target. Entering a private RFC 1918 IP address (for example: 10.x.x.x, 172.16.x.x, 192.168.x.x) results in a 400 Bad Request validation error ("conflicts with the destination IP").
    To diagnose cloud network connectivity outages, validate security policy compliance, and automate remediation workflows across your multi-cloud environment, follow these steps to configure and manage traces using Cloud Tracer:
    1. Log in to Strata Cloud Manager and go to InsightsCloud Network SecurityCloud Tracer.
    2. Click Run New Trace.
    3. In the Trace Parameters dialog, select the required Traffic Analysis option:
      • Select App to App (East-West) for internal cloud-to-cloud or VPC-to-VPC traffic.
      • Select App to Internet (North-South) for outbound egress traffic to public internet endpoints.
    4. Configure the Source and Destination details based on your selected trace direction:
      For App to App traces:
      • Source: Select Source Cloud Provider (AWS / Azure), Account, Region, VPC/VNet, and Workload/IP address.
      • Destination: Select Destination Cloud Provider, Account, Region, VPC/VNet, and Target IP address.
      • Protocol & Port: Specify the target protocol and destination port.
      For App to Internet traces:
      • Source: Select Source Cloud Provider (AWS), Account, Region, VPC, Subnet, and Workload.
      • Destination Public IP: Enter the target public IP address.
      • Protocol & Port: Select protocol and destination port.
    5. Click Run Trace.
      Cloud Tracer evaluates the path step-by-step and displays a visual path topology:
      Graphical Path: Review the generated visual map showing each hop from the source workload through Transit Gateways, GWLBs, Firewalls, and NAT Gateways to the destination node (or IGW node).
      Hop Inspection: Click any hop node in the path to open the detail panel:
      • Workload Hops: View ENI/NIC details, attached AWS Security Groups / Azure NSGs, and subnet associations.
      • Gateway Hops: Inspect TGW attachments, NAT Gateway interface configurations, and VPC route table entries.
      • Firewall Hops: Review software version, HA status, matching Security Policy rules (Allow/Drop status), Policy-Based Routing (PBR), and NAT evaluations.
      Non-Clickable Internet Node: For egress traces, the Internet node serves as the terminal visualization node after the Internet Gateway (IGW). It is non-clickable because the target destination lies outside the managed cloud fabric. The IGW node preceding it remains fully clickable to view gateway route configurations.

    Manage Saved Traces and Trace History

    Cloud Tracer stores historical trace executions and query parameters for re-testing and compliance auditing.
    1. In your Strata Cloud Manager console, go to InsightsCloud Network SecurityCloud Tracer.
      In the Trace History page, for egress traces, the destination column reflects the public target IP, while cloud provider/region fields display as N/A.
    2. Click any trace entry to reload the full interactive map and saved trace state.
    3. To re-run a trace after modifying a Security Group rule, Transit Gateway route, or firewall policy, reopen the corresponding saved query and click Run Trace to verify that traffic flow has been restored.
      You can save up to 1,000 trace queries with customized names.

    Validate Auto-Deployed Firewall Topologies

    When your firewalls are auto-deployed in AWS (for example, via GWLB, Security VPC, or Transit Gateway attachments), run a trace for the target source workload and destination endpoint.
    1. Click the Firewall hop within the generated visual topology path.
    2. Verify the following in the Firewall hop detail panel:
      • Matching rule evaluation (Allow or Drop status)
      • Policy-Based Routing and interface attachment
      • Active operational state across the firewall cluster
    3. When firewall policies or security group rules are modified during deployment, re-run saved traces from Trace History to verify restored connectivity and rule enforcement.

    © 2026 Palo Alto Networks, Inc. All rights reserved.