Category ✅

Internet for Meraki cloud is not the same as Auto VPN to HQ. Use the local status page and event log for VPN registration. Techclick CLI lab: symptoms, commands, traps, and proof.

Prisma Access needs a healthy service connection / service connection to the DC. User tunnel up is not DC reachability. Techclick CLI lab: symptoms, commands, traps, and proof.

show failover details the interface that is failed. A monitored data interface down keeps standby Failed even if LAN failover is up. Techclick CLI lab: symptoms, commands, traps, and proof.

packet-tracer will show NAT hitting the wrong rule. Add or reorder nat (inside,outside) source static obj-local obj-local destination static obj-remote obj-remote. Techclick CLI lab: symptoms, commands, traps, and proof.

DAP can terminate a session after login. debug dap trace shows which DAP record fired. Techclick CLI lab: symptoms, commands, traps, and proof.

Know the fail-open setting and the engine state. ipsmonitor tells you if the engine is dead and what the policy will do next. Techclick CLI lab: symptoms, commands, traps, and proof.

SIP session-helper or VoIP profile is rewriting SDP wrong, or RTP is not expected. Diagnose the helper and the VoIP profile before you NAT more ports. Techclick CLI lab: symptoms, commands, traps, and proof.

Relay must see the discover on the client VLAN and forward to the helper IP. dhcprelay debug shows which side is silent. Techclick CLI lab: symptoms, commands, traps, and proof.

Idle means TCP 179 never established. Check source IP, update-source, and whether the neighbor is on the correct VRF/VDOM. Techclick CLI lab: symptoms, commands, traps, and proof.

If the MPLS health-check is dead, SD-WAN will skip that member. Fix the probe, do not rewrite the rule first. Techclick CLI lab: symptoms, commands, traps, and proof.

diagnose debug flow shows the real incoming interface, NAT, and the policy that actually matched — often implicit deny or a different policy. Techclick CLI lab: symptoms, commands, traps, and proof.

conserve mode is memory pressure. Find what ate RAM, fail new proxy sessions if needed, then clear the abuser. Reboot is last. Techclick CLI lab: symptoms, commands, traps, and proof.

diagnose sys ha status on both boxes. If both say primary, heartbeat is dead. Restore HA1/HA2 first, then decide which config wins. Techclick CLI lab: symptoms, commands, traps, and proof.

The app pins certificates. Exempt that FQDN from deep inspection. wad debug confirms the inspect policy that hit. Techclick CLI lab: symptoms, commands, traps, and proof.

Web mode is reverse proxy. Tunnel mode is a full adapter. Debug sslvpn and check the tunnel IP pool, split-tunnel, and FortiClient version. Techclick CLI lab: symptoms, commands, traps, and proof.

URL category overrides are not instant and they lose to a more specific URL policy. Check policy order, location scope, and the user cloud cache. Techclick CLI lab: symptoms, commands, traps, and proof.

ZIA bandwidth classes can throttle a URL category independently of the WAN. Check the class hit in Web/Cloud App logs before you call the ISP. Techclick CLI lab: symptoms, commands, traps, and proof.

Read ZSAUpm / ZCC logs for the module that fails hash or service start. Roll back that module or repair the service, do not keep pushing the same package. Techclick CLI lab: symptoms, commands, traps, and proof.

ZPA only intercepts names you publish. Add the FQDN or the DNS search suffix to the application segment and the client forwarding profile. Techclick CLI lab: symptoms, commands, traps, and proof.

Server groups are defined by IP, FQDN, or dynamic discovery. After a subnet change, discovery still looks at the old range. Update the group, then verify from the connector. Techclick CLI lab: symptoms, commands, traps, and proof.