Prisma Access GlobalProtect Portal Reachable, Apps Dead: Service Connection Check

Prisma Access · Techclick CLI troubleshooting lab

Users connect to Prisma Access. Internet works. Internal apps die. On-prem VPN still works for the same apps.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Prisma Access for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

Prisma Access needs a healthy service connection / service connection to the DC. User tunnel up is not DC reachability.

Why this ticket shows up

The user is in the Prisma cloud. Internal apps still live in the DC. That second tunnel is a different object.

Symptoms operators actually see

• GP connected, internal fail

• Service connection down

• BGP on SC down

• New app subnet not advertised

CLI first — copy this block

Run these on the Prisma Access device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

# on the on-prem NGFW terminating the service connection
show vpn ike-sa
show vpn ipsec-sa
show routing protocol bgp summary
show routing route | match 10.30.
show global-protect-gateway current-user

How to read that output

If IPsec/BGP on the service connection is down, users will surf the web and miss every RFC1918 app.

Triage order

1. Check service connection status in Panorama/Prisma

2. On the DC firewall, prove IPsec and BGP

3. Advertise the app subnet

4. Test from a connected GP user

5. Do not rebuild GP portal

Classic traps

What you see	Real cause	Fix
Reissue GP certs	Internet already works	It is the service connection
Split-tunnel the app off Prisma	You hide the design break	Fix SC
Add the app to an internet rule	It is not internet	Advertise it internally

Proof the ticket is closed

• SC up with prefixes

• GP user reaches the app

• Internet still works

Say this in an interview

Prisma GP up plus dead internal apps is the service connection until BGP shows the prefix.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/