Reconnect Controller

1. Verify basic internet connectivity from the WAN or controller port by running the following command:

   ping <interface-id> 8.8.8.8

2. Verify DNS resolution by running nslookup google.com.
3. Check the controller connection status to determine whether the issue is a partial or full disconnection by running the following command:

   dump controller status

   A healthy output shows Controller Connection: Connected with active TCP sessions for mrl, logs_live, flows_live, and stats_live. Note missing sessions or in a non-Established state; this identifies which channel is affected. An example of good output is:

   Mic cert check passed
   Cic cert check passed
   Mic cert verify passed
   Cic cert verify passed
   CIC cert connection test done
   Device is connected to Controller

4. Run the controller reachability check to identify the stage at which connectivity fails by running the following command:

   debug controller reachability <interface-id>

   Review each check in sequence. If you see CIC cert connection test failed with curl exit Code: 7, the ION cannot reach the controller endpoint over HTTPS. This typically indicates a DNS resolution failure, a missing route, or an outbound block on port 443. Verify that port 443 is open to Palo Alto Networks controller IP addresses from this ION device.
5. If the controller connection is routed through the ION device's LAN port, verify that no path policy or security policy is blocking the traffic by running the following command:

   inspect flow brief

   Confirm the paloalto-prisma-sdwan-control application is not being denied and is taking the expected WAN path (check the SEC-ACTION and PATH columns).
6. Contact Palo Alto Networks support. Under their supervision, collect the MRL agent logs by running the command

   debug logs dump mrl_agent

   The outputs of the above command is saved in the console.