Troubleshoot the Prisma Access Deployment
Table of Contents
Expand All
|
Collapse All
Prisma Access Docs
-
5.2 Preferred and Innovation
- 5.2 Preferred and Innovation
- 5.1 Preferred and Innovation
- 5.0 Preferred and Innovation
- 4.2 Preferred
- 4.1 Preferred
- 4.0 Preferred
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
-
-
-
-
- Allocate Licenses for Prisma Access (Managed by Strata Cloud Manager)
- Plan Service Connections for Prisma Access (Managed by Strata Cloud Manager) and Add-ons
- Add Additional Locations for Prisma Access (Managed by Strata Cloud Manager) and Add-ons
- Enable Available Add-ons for Prisma Access (Managed by Strata Cloud Manager)
- Search for Subscription Details
- Share a License for Prisma Access (Managed by Strata Cloud Manager) and Add-ons
- Increase Subscription Allocation Quantity
-
- Activate a License for Prisma Access (Managed by Strata Cloud Manager) and Prisma SD-WAN Bundle
- Activate and Edit a License for SASE 5G Through Common Services
-
- General Onboarding Instructions for Prisma Access
-
3.0 Preferred and Innovation
- 4.0 & Later
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
- Prisma Access China
-
- Prisma Access
- Prisma Access Infrastructure Management
- Cadence for Software and Content Updates for Prisma Access
- Use the Prisma Access App to Get Upgrade Alerts and Updates
- View Prisma Access Software Versions
-
- Determine Your Prisma Access License Type from Panorama
- Cheat Sheet: Integrate ADEM with Panorama Managed Prisma Access
- Cheat Sheet: Integrate IoT Security with Panorama Managed Prisma Access
- Cheat Sheet: Enterprise DLP on Panorama Managed Prisma Access
- Visibility and Monitoring Features in the Prisma Access App
- Monitor Your Prisma Access Data Transfer Usage
- Zone Mapping
- Prisma Access APIs
- Prisma Access Deployment Progress and Status
- Troubleshoot the Prisma Access Deployment
-
- Prisma Access Mobile User Deployments
- How the GlobalProtect App Selects a Prisma Access Location for Mobile Users
- Integrate Prisma Access with On-Premises Gateways
-
- Set Equal Gateway Priorities for On-Premises and Prisma Access Gateways
- Set a Higher Gateway Priority for an On-Premises Gateway
- Set Higher Priorities for Multiple On-Premises Gateways
- Configure Priorities for Prisma Access and On-Premises Gateways
- Allow Mobile Users to Manually Select Specific Prisma Access Gateways
- Report Prisma Access Website Access Issues
-
- Multitenancy Overview
- Multitenancy Configuration Overview
- Plan Your Multitenant Deployment
- Create an All-New Multitenant Deployment
- Enable Multitenancy and Migrate the First Tenant
- Add Tenants to Prisma Access
- Delete a Tenant
- Create a Tenant-Level Administrative User
- Sort Logs by Device Group ID in a Multitenant Deployment
-
-
-
- Default Routes With Prisma Access Traffic Steering
- Traffic Steering in Prisma Access
- Traffic Steering Requirements
- Default Routes with Traffic Steering Example
- Default Routes with Traffic Steering Direct to Internet Example
- Default Routes with Traffic Steering and Dedicated Service Connection Example
- Prisma Access Traffic Steering Rule Guidelines
- Configure Zone Mapping and Security Policies for Traffic Steering Dedicated Connections
- Configure Traffic Steering in Prisma Access
-
-
-
- Integrate Prisma Access With Other Palo Alto Networks Apps
- Integrate Third-Party Enterprise Browser with Explicit Proxy
- Integrate Third-Party NDRs with Prisma Access
- Juniper Mist Integration for SASE Health
-
-
- Connect your Mobile Users in Mainland China to Prisma Access Overview
- Configure Prisma Access for Mobile Users in China
- Configure Real-Name Registration and Create the VPCs in Alibaba Cloud
- Attach the CEN and Specify the Bandwidth
- Create Linux Instances in the Alibaba Cloud VPCs
- Configure the Router Instances
- Onboard the GlobalProtect Gateway and Configure the Prisma Access Portal
-
-
-
- INC_CIE_AGENT_DISCONNECT
- INC_CIE_DIRECTORY_DISCONNECT
- INC_GLOBALPROTECT_GW_USER_AUTH_ TIMEOUT_FAILURES_COUNT_EXCEEDED_ ABOVE_BASELINE_ALL_PA_LOCATIONS
- INC_GLOBALPROTECT_GW_USER_AUTH_ TIMEOUT_FAILURES_COUNT_EXCEEDED_ ABOVE_BASELINE_PER_PA_LOCATION
- INC_GLOBALPROTECT_PORTAL_AUTH_ TIMEOUT_FAILURES_COUNT_EXCEEDED_ ABOVE_BASELINE_ALL_PA_LOCATIONS
- INC_GLOBALPROTECT_PORTAL_AUTH_ TIMEOUT_FAILURES_COUNT_EXCEEDED_ ABOVE_BASELINE_PER_PA_LOCATION
- INC_MU_AUTH_SERVER_UNREACHABLE_ALL_ PA_LOCATIONS
- INC_MU_AUTH_SERVER_UNREACHABLE_PER_ PA_LOCATION
- INC_MU_DNS_SERVER_UNREACHABLE_ALL_ PA_LOCATIONS
- INC_MU_DNS_SERVER_UNREACHABLE_ PER_PA_LOCATION
- INC_PORTAL_CLIENTLESS_VPN_AUTH_ TIMEOUT_FAILURES_COUNT_EXCEEDED_ ABOVE_BASELINE_ALL_PA_LOCATIONS
- INC_PORTAL_CLIENTLESS_VPN_AUTH_ TIMEOUT_FAILURES_COUNT_EXCEEDED_ ABOVE_BASELINE_PER_PA_LOCATION
- INC_RN_AUTH_SERVER_UNREACHABLE_ALL_ PA_LOCATIONS
- INC_RN_AUTH_SERVER_UNREACHABLE_PER_ PA_LOCATION
- INC_RN_DNS_SERVER_UNREACHABLE_ALL_ PA_LOCATIONS
- INC_RN_DNS_SERVER_UNREACHABLE_PER_ PA_LOCATION
- INC_RN_ECMP_TUNNEL_RTT_EXCEEDED_ BASELINE
- INC_RN_PRIMARY_WAN_TUNNEL_RTT_ EXCEEDED_BASELINE
- INC_RN_SECONDARY_TUNNEL_DOWN
- INC_RN_SECONDARY_WAN_TUNNEL_RTT_ EXCEEDED_BASELINE
- INC_RN_SITE_CAPACITY_PREDICTION
- INC_SC_PRIMARY_WAN_TUNNEL_RTT_ EXCEEDED_BASELINE
- INC_SC_SECONDARY_WAN_TUNNEL_RTT_ EXCEEDED_BASELINE
- INC_SC_SITE_CAPACITY_PREDICTION
-
- INC_CERTIFICATE_EXPIRY
- INC_GP_CLIENT_VERSION_UNSUPPORTED
- INC_MU_IP_POOL_BLOCK_UTILIZATION_ EXCEEDED_CAPACITY
- INC_MU_IP_POOL_BLOCK_UTILIZATION_ EXCEEDED_THRESHOLD
- INC_PA_INFRA_DEGRADATION
- INC_PA_SERVICE_DEGRADATION_PA_LOCATION
- INC_PA_SERVICE_DEGRADATION_RN_ SITE_CONNECTIVITY
- INC_PA_SERVICE_DEGRADATION_SC_ CONNECTIVITY
- INC_RN_ECMP_BGP_DOWN
- INC_RN_ECMP_BGP_FLAP
- INC_RN_ECMP_PROXY_TUNNEL_DOWN
- INC_RN_ECMP_PROXY_TUNNEL_FLAP
- INC_RN_ECMP_TUNNEL_DOWN
- INC_RN_ECMP_TUNNEL_FLAP
- INC_RN_PRIMARY_WAN_BGP_FLAP
- INC_RN_PRIMARY_WAN_PROXY_TUNNEL_DOWN
- INC_RN_PRIMARY_WAN_PROXY_TUNNEL_FLAP
- INC_RN_PRIMARY_WAN_TUNNEL_DOWN
- INC_RN_PRIMARY_WAN_TUNNEL_FLAP
- INC_RN_SECONDARY_WAN_BGP_DOWN
- INC_RN_SECONDARY_WAN_BGP_FLAP
- INC_RN_SECONDARY_WAN_PROXY_TUNNEL_DOWN
- INC_RN_SECONDARY_WAN_PROXY_TUNNEL_FLAP
- INC_RN_SECONDARY_WAN_TUNNEL_DOWN
- INC_RN_SECONDARY_WAN_TUNNEL_FLAP
- INC_RN_SITE_DOWN
- INC_RN_SITE_LONG_DURATION_CAPACITY_ EXCEEDED_THRESHOLD
- INC_RN_SITE_LONG_DURATION_EXCEEDED_ CAPACITY
- INC_RN_SPN_LONG_DURATION_CAPACITY_EXCEEDED _THRESHOLD
- INC_RN_SPN_LONG_DURATION_EXCEEDED_ CAPACITY
- INC_SC_PRIMARY_WAN_BGP_DOWN
- INC_SC_PRIMARY_WAN_BGP_FLAP
- INC_SC_PRIMARY_WAN_PROXY_TUNNEL_DOWN
- INC_SC_PRIMARY_WAN_PROXY_TUNNEL_FLAP
- INC_SC_PRIMARY_WAN_TUNNEL_DOWN
- INC_SC_PRIMARY_WAN_TUNNEL_FLAP
- INC_SC_SECONDARY_WAN_BGP_DOWN
- INC_SC_SECONDARY_WAN_BGP_FLAP
- INC_SC_SECONDARY_WAN_PROXY_TUNNEL_DOWN
- INC_SC_SECONDARY_WAN_PROXY_TUNNEL_FLAP
- INC_SC_SECONDARY_WAN_TUNNEL_DOWN
- INC_SC_SECONDARY_WAN_TUNNEL_FLAP
- INC_SC_SITE_DOWN
- INC_SC_SITE_LONG_DURATION_CAPACITY_ EXCEEDED_THRESHOLD
- INC_SC_SITE_LONG_DURATION_EXCEEDED_ CAPACITY
- INC_ZTNA_CONNECTOR_APP_STATUS_DOWN
- INC_ZTNA_CONNECTOR_APP_STATUS_DOWN_PARTIAL
- INC_ZTNA_CONNECTOR_CPU_HIGH
- INC_ZTNA_CONNECTOR_MEMORY_HIGH
- INC_ZTNA_CONNECTOR_TUNNEL_DOWN
-
- AL_CIE_AGENT_DISCONNECT
- AL_CIE_DIRECTORY_DISCONNECT
- AL_MU_IP_POOL_CAPACITY
- AL_MU_IP_POOL_USAGE
- AL_RN_ECMP_BGP_DOWN
- AL_RN_ECMP_BGP_FLAP
- AL_RN_PRIMARY_WAN_BGP_DOWN
- AL_RN_PRIMARY_WAN_BGP_FLAP
- AL_RN_PRIMARY_WAN_TUNNEL_DOWN
- AL_RN_PRIMARY_WAN_TUNNEL_FLAP
- AL_RN_SECONDARY_WAN_BGP_DOWN
- AL_RN_SECONDARY_WAN_BGP_FLAP
- AL_RN_SECONDARY_WAN_TUNNEL_DOWN
- AL_RN_SECONDARY_WAN_TUNNEL_FLAP
- AL_RN_SITE_DOWN
- AL_RN_SITE_LONG_DURATION_CAPACITY_ EXCEEDED_THRESHOLD
- AL_RN_SITE_LONG_DURATION_EXCEEDED_ CAPACITY
- AL_RN_SPN_LONG_DURATION_CAPACITY_ EXCEEDED_THRESHOLD
- AL_SC_PRIMARY_WAN_BGP_DOWN
- AL_SC_PRIMARY_WAN_BGP_FLAP
- AL_SC_PRIMARY_WAN_TUNNEL_DOWN
- AL_SC_PRIMARY_WAN_TUNNEL_FLAP
- AL_SC_SECONDARY_WAN_BGP_DOWN
- AL_SC_SECONDARY_WAN_BGP_FLAP
- AL_SC_SECONDARY_WAN_TUNNEL_DOWN
- AL_SC_SECONDARY_WAN_TUNNEL_FLAP
- AL_SC_SITE_DOWN
- AL_SC_SITE_LONG_DURATION_CAPACITY_ EXCEEDED_THRESHOLD
- AL_SC_SITE_LONG_DURATION_EXCEEDED_CAPACITY
- AL_ZTNA_CONNECTOR_APP_STATUS_DOWN
- AL_ZTNA_CONNECTOR_APP_STATUS_DOWN_PARTIAL
- AL_ZTNA_CONNECTOR_CPU_HIGH
- AL_ZTNA_CONNECTOR_MEMORY_HIGH
- AL_ZTNA_CONNECTOR_TUNNEL_DOWN
- New Features in Incidents and Alerts
- Known Issues
Troubleshoot the Prisma Access Deployment
Use Logging Status, Routing Information, and EDL Info
and Status to retrieve troubleshooting information.
The Troubleshooting Commands area
in Panorama (PanoramaCloud
ServicesConfigurationService SetupService OperationsTroubleshooting
Commands) enables you to easily retrieve
the logging status of Prisma Access infrastructure components, as
well as retrieve the latest information about External Data Lists
(EDLs) that are used with Prisma Access. This information can be
useful to monitor and troubleshoot issues with your Prisma Access
deployment.
- If you are having issues with receiving logs from one or more locations, you can check the Logging Status for a mobile user or remote network security processing node (SPN) to check the connectivity status of Strata Logging Service with that SPN.
- If you are experiencing routing issues with service connections, also known as Corporate Access Nodes (CANs), or Remote Network SPNs, you can view the Prisma Access routing tables.
- If you are having issues with EDLs not being updated in a timely fashion, you can query Prisma Access to see what information (IP addresses or URLs) are included in the EDLs. You can also refresh the EDL information.
To export the results of the
troubleshooting commands to a .csv file, select Export
to CSV after running the command.

The Troubleshooting
Commands window displays the following information:
Tab | Description |
---|---|
Logging Status | Provides you with the connection status
between Strata Logging Service and the Prisma Access mobile user security
processing nodes (MU-SPNs) or remote network security processing
nodes (RN-SPNs). To view Mobile Users MU-SPN
logging information, select the Prisma Access Location from
the drop-down, or select All to view the
logging status for all locations. To view Remote Networks RN-SPN
information, select the Site Name from the
drop-down, or select All to view all remote
networks. The Retrieved Data table shows
the following information:
|
Routing Information | Provides you with routing information for
service connection corporate access nodes (SC-CANs) and for RN-SPNs.
To view SC-CAN information, select the Service Connection name
from the drop-down; to view RN-SPN information, select the Site
Name from the drop-down. Click Show Route
Table to show the routing table for the service connection
or remote network connection. The Retrieved Data table
shows the following information:
|
EDL Info | Displays information about External Dynamic Lists (EDLs) for Mobile
Users MU-SPNs and Remote Networks RN-SPNs. For
MU-SPNs, select the EDL Type and the EDL
Name for the type you specified from the drop-down choices;
then, enter the IP address of the mobile user location (gateway)
(Mobile Users GW IP address). To find the IP address of a mobile user gateway from
the GlobalProtect app, open the Settings and
find the Gateway IP address in the Connection tab.
To find the IP address of a mobile user gateway from Prisma Access,
use the API to retrieve Prisma Access
infrastructure IP addresses using the "serviceType": "gp_gateway" keywords
in the .txt file. For RN-SPNs, select the EDL
Type, the EDL Name for the type
you specified, and the Remote Networks Site Name. After
you Show EDL Info, the Retrieved
Data table shows the following information:
|
EDL Status | Displays the status of the EDLs used by
Prisma Access for Mobile Users and Remote Networks MU-SPNs
and RN-SPNs. For MU-SPNs, select the EDL Type and
the EDL Name for the type you specified from
the drop-down choices; then, enter the IP address of the mobile
user location (gateway) (Mobile Users GW IP address). To find the IP address of a mobile user gateway from
the GlobalProtect app, open the Settings and
find the Gateway IP address in the Connection tab.
To find the IP address of a mobile user gateway from Prisma Access,
use the API to retrieve Prisma Access
infrastructure IP addresses using the "serviceType": "gp_gateway" keywords
in the .txt file. For RN-SPNs, select the EDL
Type, the EDL Name for the type
you specified, and the Remote Networks Site Name. Predefined
URLs are not supported. The Retrieved Data table
shows the following information:
|
EDL Refresh | Refreshes the EDLs for Mobile
Users and Remote Networks MU-SPNs
and RN-SPNs. You cannot refresh predefined EDLs. Refreshing
an EDL is resource-intensive. Palo Alto Networks recommends that
you refresh the EDLs a maximum of once every two minutes. If you
do not manually refresh the EDLs, Prisma Access automatically refreshes
External Dynamic Lists (EDLs) using the Check for Updates value
you defined in each EDL. For MU-SPNs, select the EDL
Type and the EDL Name for the
type you specified from the drop-down choices; then, enter the IP
address of the mobile user location (gateway) (Mobile
Users GW IP address). To find
the IP address of a mobile user gateway from the GlobalProtect app,
open the Settings and find the Gateway IP address
in the Connection tab. To find the IP address
of a mobile user gateway from Prisma Access, use the API to retrieve Prisma Access
infrastructure IP addresses using the "serviceType": "gp_gateway" keywords
in the .txt file. For RN-SPNs, select the EDL
Type, the EDL Name for the type
you specified, and the Remote Networks Site Name. The Retrieved
Data table shows the Message related
to the EDL refresh operation (either that the EDL refresh operation
is queued or that it is complete) and the Timestamp when
the refresh operation was performed. The timestamp uses the local
time of the MU-SPN or RN-SPN. To view the last time that the
status was refreshed, select the EDL Status tab.
To see the EDL information after it was refreshed, select the EDL
Info tab. |
Search EDL | Enter search terms to find data inside the
EDLs you use with mobile users and remote networks in Prisma Access.
This functionality does not work with Predefined URL lists or URL
lists that you create; EDLs that use IP addresses are supported. You
can enter search terms for either Mobile Users or Remote
Networks. To search for Mobile Users,
enter the IP address of the mobile user location (gateway) for which
you want to search (Mobile Users GW IP address)
with the Search String; to search in the Remote
Networks area, enter the Site Name with
the Search String. Click Search
EDL to perform the search. If the string is matched
in an EDL, the Retrieved Data table shows
the EDL Name where the search string was
matched, along with the Timestamp when the
match was made. The timestamp uses the date and time of the Panorama
that manages Prisma Access. |