Step 1: Review the incident details and record the affected tenant, site, ION, incident start time, duration, software version, and related incidents.
Step 2: In Strata Cloud Manager, navigate to Configuration > Prisma SD-WAN > Policies > Security > Security Profile Groups. Confirm that a DNS Security Profile is included in the applicable Security Profile Group and that the group is applied to the affected site.
If the Security Profile Groups option is not visible, confirm that the Branch Security subscription is assigned to the tenant.
Step 3: Navigate to Configuration > Prisma SD-WAN > Devices > Claimed Devices and hover over the affected device’s Online/Offline status. Review:
DNS Security Cloud Connection Status
URL Security Services Connection Status
Logging Service Connection Status
Config and Events
Analytics
Flows
Last Disconnected Time
Last Reboot Reason
Determine whether only DNS Security is disconnected or whether the ION has a broader cloud-connectivity problem.
Step 4: Access the ION through the Remote CLI Toolkit if the ION is online. If the controller connection is also down, use SSH or console. Run the following commands where supported:
dump overview
dump dns-security state json
dump dns-security agent status
dump dns-security config json
dump security-policy config profile-groups all
Step 5: Review the output and confirm:
DNS Security Server Connection in dump overview
enabled: true
configured_in_policy: true
initialization_complete: true
dnssec_agent_connected: true
service_status: Running
support_state: Active
connection_state: Connected
Recent last_receive_time and last_send_time
The last_reconnect_time and last_disconnect_reason
The selected source_interface
source_interface_selection_state: Completed
The configured DNS Security Cloud FQDN
The expected DNS Security Profile in the applicable profile group
Step 6: Check the interface selected by the DNS Security agent:
dump interface status <source_interface>
dump interface config <source_interface>
Confirm that the interface is operational and has a valid IP address, default route, gateway, and DNS server.
Step 7: Test DNS resolution and connectivity to the DNS Security Cloud endpoint reported by dump dns-security config json. The expected endpoint in the supplied output is dns.service.paloaltonetworks.com:
ping <source_interface> dns.service.paloaltonetworks.com
tcpping <source_interface> dns.service.paloaltonetworks.com:443
A hostname resolved to an IP address confirms that DNS resolution is working. A failed ICMP response alone does not prove the service is unreachable because ICMP may be blocked. The TCP 443 test is the primary connectivity check.
If hostname resolution fails, obtain the DNS server address from the interface-status output and run:
dig <source_interface> <dns_server_ip> dns.service.paloaltonetworks.com
Step 8: If the connectivity test fails, verify routing, DNS, NAT, and upstream firewall policies. Confirm that outbound TCP port 443 to the DNS Security Cloud is allowed and that a proxy or TLS-inspection policy is not interfering with the connection.
Step 9: If the CLI shows enabled: false, configured_in_policy: false, or a missing DNS Security Profile, correct the configuration in Strata Cloud Manager and push it to the ION. Do not modify the configuration locally from the toolkit on a claimed or assigned ION.
Step 10: After remediation, confirm:
connection_state: Connected
dnssec_agent_connected: true
last_receive_time and last_send_time continue to update
DNS Security Cloud Connection Status shows Online in SCM
The incident clears automatically
If SLS logging is licensed and enabled, review current DNS logs under Network > DNS or the Domains view in Activity Insights to confirm that DNS Security verdicts are being received.
Step 11: If the incident persists or repeatedly returns, save the command outputs and collect a support bundle:
dump-support all file=dns-security-cloud-down
For earlier releases that do not support the all option:
dump-support outputs file=dns-security-cloud-down
Attach the incident details, CLI outputs, reachability-test results, and support bundle to a Palo Alto Networks Support case. Do not restart the DNS Security agent or reboot the ION unless instructed by Support. | 