Step 1: Review the incident details and identify the affected ION interface.

Step 2: SSH to the ION and run:

dump interface status <port number>

Record the current interface state, speed, and duplex mode.

Step 3: Verify the cable connection and replace the cable with a known-good cable of the correct type.

Step 4: Check the connected equipment’s port configuration. Prefer enabling auto-negotiation on both ends. If fixed settings are required, configure the same supported speed and full-duplex mode on both ends.

Step 5: Locate the affected ION, go to Interfaces, select the interface, and open Advanced Options > PHYSICAL. Configure the physical settings to match the connected equipment and save the change.

Step 6: Run dump interface status <port number> again and confirm that the interface is up and displays Duplex: full.

For ION release 5.6.1 or later, you can also run:

dump dpdk port status port=<port number>

Confirm that the link is detected and the speed, duplex, and auto-negotiation settings are correct.

Step 7: If the interface remains in half-duplex mode, save the command outputs and contact Palo Alto Networks Support.

Step 1: Review the incident details and note the affected site, ION, interface, incident time and duration, and any related interface or controller-connectivity incidents. Check whether the configuration difference is affecting traffic, controller connectivity, or another interface function.

Step 2: Go to Configuration > Prisma SD-WAN > Devices > Claimed Devices and locate the affected ION. Review Device State and Config and Events. If either connection is Offline, check for DEVICESW_DISCONNECTED_FROM_CONTROLLER and follow the DEVICESW_DISCONNECTED_FROM_CONTROLLER remediation before trying to synchronize the configuration.

Step 3: In the Remote CLI Toolkit, use the following read-only commands to record the configuration and operational state currently present on the ION:

dump interface config <interface>

dump interface status <interface>

Replace <interface> with the interface name or number shown in the incident details. If the incident does not identify the interface, run:

dump interface config all

Do not make any additional interface changes through the CLI.

Step 4: In SCM, select the affected ION and open Interfaces. Compare the controller configuration with the CLI output. Review the settings relevant to the interface, such as administrative state, interface type and use, IPv4 or IPv6 configuration, IP address, default gateway, DNS servers, circuit label, scope, VRF, VLAN, and MTU.

Step 5: Determine which configuration is intended:

If the local change was intentional, enter the same intended settings in SCM.

If the local change was accidental, edit and save the approved interface settings in SCM so the controller sends the authoritative configuration to the ION.

Make all configuration changes through SCM. Before saving, confirm that the intended configuration will preserve controller connectivity and required WAN or LAN connectivity. If the affected interface is the only available controller path or the correct settings are not known, open a case with Palo Alto Networks Support before making the change.

Step 6: After saving the configuration, monitor Config and Events and wait for the controller to apply the update. Run the following commands again and confirm that the interface configuration and operational state match the values configured in SCM:

dump interface config <interface>

dump interface status <interface>

Verify that the interface is operating as expected and that the incident clears.

Step 7: If the configuration remains out of sync, the controller cannot apply the update, or the incident returns without another local CLI change, collect a support bundle and open a case with Palo Alto Networks Support.

dump-support all file=interface_config_outofsync_<ion_name>

For earlier releases that do not support the all option:

dump-support outputs file=interface_config_outofsync_<ion_name>

Replace <ion_name> with the affected ION’s name as shown on the Claimed Devices page.

Step 1: Review the incident details and determine whether the incident is still active or has cleared. Record the affected ION, incident time, Reason, and Exception Text for Support.

Step 2: Go to Configuration > Prisma SD-WAN > Devices > Claimed Devices and hover over the affected ION’s status. Confirm that Device State and Config and Events are Online. Check for related hardware, software, temperature, or process incidents.

Step 3: If the incident clears and does not return, continue monitoring the ION and its health incidents.

Step 4: If the incident remains active or repeatedly returns, collect a support bundle and open a Palo Alto Networks Support case. Include the incident details and any related incidents.

dump-support all file=<descriptive_filename>

For releases earlier than 6.4.1 that do not support the all option:

dump-support outputs file=<descriptive_filename>

Use a filename containing the ION name and collection time, such as monitor_disabled_branch-ion1_20260818T1430.

Step 1: Review the incident details and record the hub cluster, hub site, incident time, mapped branch count, and configured Maximum Branch Site Count (Soft Limit).

Step 2: In SCM, go to Configuration > Prisma SD-WAN > Data Centers, select the data center site, and review DC Clusters. Compare the Branches/Limit value with the intended design.

Step 3: Verify that the mapped branch sites are assigned to the correct hub cluster and correct any unintended assignments.

Step 4: If the mappings are intentional, increase or remove the soft limit only after confirming that the hub-cluster design and resources support the planned branch count, or distribute branches to another cluster.

Step 5: Confirm that the branch count is within the configured soft limit and the incident clears.

Step 6: If the cluster design or supported scale is uncertain, open a Palo Alto Networks Support case for capacity review.

Step 1: Review the incident details and record the affected ION, ION software version, incident time, and whether the incident is persistent or recurring.

Step 2: SSH to the affected ION and run:

dump appdef version

Save the output, including the App-def-version, App-content-config-version, and App-content-sig-version values.

Step 3: If the incident clears and does not recur, continue monitoring the ION.

Step 4: If the incident remains active or recurs, collect a support bundle.

For Release 6.4.1 or later:

dump-support all file=appdef-sigfile-mismatch

For earlier supported releases:

dump-support outputs file=appdef-sigfile-mismatch

Step 5: Open a Palo Alto Networks Support case and attach the incident details, dump appdef version output, support bundle, and ION software version.

Step 6: Do not restart the ION, the app engine, or modify custom application definitions unless instructed by Support.

The incident identifies the custom application in the Entity field and provides the conflicting application ID in the Conflict App ID field. The applications have overlapping port ranges, prefix filters, or other matching criteria.

Step 1: Convert the Conflict App ID to the application name.

inspect priority-policy lookup application=<conflict-app-id> | grep Requested

Step 2: Review both application definitions.

dump appdef config application=<entity-application-name>

dump appdef config application=<conflicting-application-name>

Step 3: Based on the Rule Type reported in the incident, compare the TCP or UDP port ranges and prefix filters to identify the overlap.

Step 4: Modify or remove the overlapping rule from the custom application so that its matching criteria are unique. Do not modify the predefined application.

Step 5: Verify that the updated configuration is applied and that the incident is cleared.

Step 6: If the incident persists, collect the incident details and the output of the application-definition commands, and contact Palo Alto Networks Support.

Step 1: Navigate to Configuration > Prisma SD-WAN > Sites, select the affected site, and open Configuration > Connectivity and Circuits.

Step 2: Edit the affected internet or private WAN circuit and review App Reachability Probes. Set it to Yes, or select Use Circuit Category Setting to inherit the setting from the assigned circuit category.

Step 3: If Use Circuit Category Setting is selected, navigate to Configuration > Prisma SD-WAN > Resources > Circuit Categories. Edit the circuit category assigned to the affected circuit and enable Use for Application Reachability Probes.

Note: A setting configured directly on the circuit takes precedence over the circuit-category setting. If the circuit is set to No, enabling probes under the circuit category will not enable them for that circuit.

Step 4: Navigate to Configuration > Prisma SD-WAN > ION Devices > Claimed and select the affected device. Under Interfaces, verify that the probe source interface is configured as a Layer 3 LAN interface and that Admin Up is set to Yes.

Step 5: Under Basic Info, enable Application Reachability Probe Source Interface and select the appropriate LAN interface.

For ION 3000, 7000, and 9000 devices, Source Interface can be set to None to use the Controller 1 interface. For ION 1000, 1200, 1200-S, 3200, 5200, and 9200 devices, configure a LAN interface as the application-probe source.

Step 6: Verify the application-probe configuration and status from the ION CLI.

dump app probe config

dump app probe status

Step 7: Confirm that application probes are enabled and that the incident is cleared.

Step 8: If the incident persists after verifying the configuration, collect the incident details and the application-probe command outputs, and contact Palo Alto Networks Support.

Step 1: Review the incident details and record the affected ION, interface, duplicate IPv6 address, and incident time.

Step 2: Determine whether the incident occurred during or immediately after an ION RMA replacement.

Step 3: If this is an RMA replacement, the transferred IPv6 interface configuration may initially be inactive. During an appropriate maintenance window, set the replacement interface Admin Down and then Admin Up to activate its IPv6 configuration.

Step 4: For a non-RMA event, go to Configuration > Prisma SD-WAN > ION Devices > Claimed, select the affected interface, and determine whether its IPv6 address is static or dynamically assigned.

You can also run:

dump interface config <interface>

Step 5: If the IPv6 address is static, confirm through IPAM and the network configuration that it is not assigned to another device. If it is dynamically assigned, review the DHCPv6 server’s leases and reservations. Also check for a manually configured device using the same address.

Step 6: To identify the neighboring device and its MAC address, run:

inspect system ipv6-neighbor all

Use the resulting MAC address, when available, to locate the conflicting device through the connected switch or network inventory.

Step 7: Correct the duplicate assignment by changing the IPv6 address on either the ION or the conflicting device. Do not change both devices unnecessarily.

Step 8: Confirm that the interface remains operational, the IPv6 address is unique, and the incident clears. If it remains active, attach the incident details, interface configuration, and IPv6-neighbor output to a Palo Alto Networks Support case.

Step 1: Review the incident details and record the affected site, ION, entity type (such as interface, circuit, or VPN link), incident time, software version, and the observed flap rate.

Step 2: Identify the entity that is flapping and review its current state and recent incident history.

Step 3: For interface or circuit flapping, review related DEVICEHW_INTERFACE_DOWN or CIRCUIT_PERFORMANCE_DEGRADED incidents and check physical cabling and carrier connectivity.

Step 4: For VPN link flapping, review related NETWORK_ANYNETLINK_DOWN or NETWORK_ANYNETLINK_DEGRADED incidents.

Step 5: Address the underlying cause of the instability identified in the entity-specific incidents.

Step 6: Monitor the entity to confirm the flap rate drops below the threshold after the underlying issue is resolved.

Step 7: If the flap rate cannot be explained or resolved, run dump-support all file=<descriptive_filename> (Release 6.4.1 and later) or dump-support outputs file=<descriptive_filename> (earlier releases), where <descriptive_filename> is a user-selected name such as event_name_ion-name_YYYYMMDDTHHMM.

Step 1: Review the incident details and record the affected site, ION, incident time, software version, Path Policy stack, policy set, and conflicting rules.

Step 2: In SCM, go to Configuration > Prisma SD-WAN > Policies > Paths > Path Stacks.

For a simple stack, select Simple and open the applicable Path Policy stack. For an advanced stack, select Advanced, open the applicable Path Policy stack and Path Set, and review the conflicting rules identified in the incident.

Step 3: Review the order, match criteria, and path actions of the conflicting rules. Determine the intended policy behavior for the affected application traffic.

Step 4: Correct the conflict by changing the rule order, match criteria, or path actions, or by removing a duplicate or unnecessary rule.

Step 5: Save the changes through SCM and confirm that the corrected Path Policy stack is bound to the affected site.

Step 6: Monitor the affected site and confirm that the incident clears and the intended Path Policy is applied.

Step 7: If the conflicting rules cannot be identified or the incident persists after the configuration is corrected, collect a support bundle and open a Palo Alto Networks Support case:

dump-support all file=<descriptive_filename>

For releases earlier than 6.4.1 that do not support the all option:

dump-support outputs file=<descriptive_filename>

Use a filename containing the event, ION name, and collection time, such as network_policy_rule_conflict_branch-ion1_YYYYMMDDTHHMM.

Step 1: Review the incident details and record the affected site, ION, incident time, software version, QoS stack, QoS set, and conflicting rules.

Step 2: In SCM, go to Configuration > Prisma SD-WAN > Policies > QoS > QoS Stacks. For an advanced stack, select Advanced > QoS Sets and open the affected set.

Step 3: Run inspect priority-policy conflicts and compare the reported rule identifiers with the SCM configuration.

Step 4: Review rule order, match criteria, priority class, and DSCP actions, then correct unintended overlap or conflicting actions.

Step 5: Save and push the corrected configuration, run inspect priority-policy conflicts again, and confirm that the incident clears.

Step 6: If the conflict cannot be identified or persists, collect a support bundle and open a Palo Alto Networks Support case.

Step 1: Review the incident details and record the affected site, ION, Path Policy stack, rule, and missing path labels.

Step 2: In SCM, go to Configuration > Prisma SD-WAN > Policies > Paths > Path Stacks and identify the rule that references the missing label.

Step 3: Review the WAN interface configuration at the affected site and confirm which path labels are assigned.

Step 4: Assign each required missing label to the intended site WAN interface, or update the Path Policy rule to use labels that are available at the site.

Step 5: Save and push the corrected configuration and confirm that the Path Policy can use the intended circuit and the incident clears.

Step 6: If the label mismatch cannot be resolved, collect a support bundle and open a Palo Alto Networks Support case.

Step 1: Review the incident details and record the affected site, ION, incident time, software version, bound domain, Path Policy stack and rule, and Service & DC Groups identified in the incident.

Step 2: In SCM, go to Configuration > Prisma SD-WAN > Policies > Paths > Path Stacks and locate the Path Policy rule applied to the affected site. Identify the Service & DC Group configured as an active or backup service path.

Step 3: Confirm that the rule references the intended Service & DC Group and correct the rule if the wrong group is selected.

Step 4: Go to Configuration > Prisma SD-WAN > Resources > Service & DC Groups, select Manage Endpoints, and confirm that the required Prisma SD-WAN data center or Standard VPN service endpoint exists and is Admin Up.

Step 5: Verify that the affected site is bound to the intended domain and that the domain maps a valid endpoint to every Service & DC Group referenced by the Path Policy.

Step 6: Correct the domain, group, endpoint, or Path Policy mapping and save the configuration.

Step 7: Push the corrected Path Policy configuration and confirm that the referenced service path becomes available and the incident clears.

Step 8: If all mappings are correct but the incident remains active, collect a support bundle and open a Palo Alto Networks Support case.

Step 1: Review the incident details and record the affected site, ION, incident time, software version, Security stack and set, and incomplete rule identifiers.

Step 2: In SCM, go to Configuration > Prisma SD-WAN > Policies > Security > Security Stacks and open the affected Simple or Advanced policy. For an advanced stack, review the applicable Security Set.

Step 3: Identify each incomplete rule and provide all required match criteria, actions, applications, prefixes, zones, or referenced objects.

Step 4: Save and push the corrected policy and confirm that all required rules are complete and active.

Step 5: If the rule cannot be completed or the incident persists, collect a support bundle and open a Palo Alto Networks Support case.