Category ✅

Prisma Access needs a healthy service connection / service connection to the DC. User tunnel up is not DC reachability. Techclick CLI lab: symptoms, commands, traps, and proof.

Split hardware down from protocol down. Speed/duplex, aggregate membership, and vsys assignment are the usual post-reboot surprises. Techclick CLI lab: symptoms, commands, traps, and proof.

Policy Based Forwarding is a first lookup. If test pbf-policy-match misses, the virtual router default route wins. Check source zone, enforce symmetric return, and next-hop liveliness. Techclick CLI lab: symptoms, commands, traps, and proof.

Check WildFire status, forwarding, and file-size limits. Pending forever usually means no cloud reachability or the file type is not forwarded. Techclick CLI lab: symptoms, commands, traps, and proof.

Zone protection and flood protection drop before policy. Read show counter global filter severity drop and the zone-protection profile counters. Techclick CLI lab: symptoms, commands, traps, and proof.

A Panorama commit is not a firewall commit. Use show jobs processed on Panorama and on the firewall, then push again only to the devices that failed. Techclick CLI lab: symptoms, commands, traps, and proof.

unknown-tcp means App-ID did not finish. Give it time and a decoder first. Application-override is a scalpel for a known private protocol, not a shortcut for every deny. Techclick CLI lab: symptoms, commands, traps, and proof.

Use show running resource-monitor and packet-diag before reboot. High CPU is usually one flow, one app-id, or one flood — reboot only hides the next cycle. Techclick CLI lab: symptoms, commands, traps, and proof.

If show user ip-user-mapping ip <host> is empty, the user rule cannot match. Fix the agent, WMI, or syslog mapping before you change policy. Techclick CLI lab: symptoms, commands, traps, and proof.

Run test nat-policy-match for both directions. If destination NAT is missing or source NAT is hiding the server, the return packet never finds the original session. Techclick CLI lab: symptoms, commands, traps, and proof.

Portal and gateway are different listeners. Prove portal auth, then test the gateway IP, SSL profile, and client IP pool separately. Techclick CLI lab: symptoms, commands, traps, and proof.

Identify the session, confirm it is decrypted, then exclude that app or that certificate pin from ssl-inbound/forward-proxy. Do not turn off decryption globally. Techclick CLI lab: symptoms, commands, traps, and proof.

Use test security-policy-match with the real 5-tuple and application. If the result is interzone-default, the session never reached your intended rule — fix zone, user, or app-id before you add another any-any. Techclick CLI lab: symptoms, commands, traps, and proof.

Phase-1 only proves IKE identity. Phase-2 dies when proxy-IDs / encryption domains do not match. Align local/remote networks, not the IKE gateway. Techclick CLI lab: symptoms, commands, traps, and proof.

Run show high-availability state on both peers. If one side is suspended, clear the suspend, confirm HA1/HA2 are up, then fail over only after running-config is synced. Techclick CLI lab: symptoms, commands, traps, and proof.

The rule looks correct, the traffic still gets denied. Here is the exact order to prove which rule matched, why App-ID changed the answer mid-session, and the shadowing check most engineers skip.