Prisma Access Troubleshooting and Optimization
What this domain tests
Troubleshooting tests a structured path from client to Prisma Access to destination, plus tuning for latency, throughput, and reliability.
Core rules
- Scope the problem: one user, one site, one application, or all traffic. Check GlobalProtect app logs, portal/gateway selection, authentication, and HIP results.
- On the platform, use
show vpn ike-sa,show vpn ipsec-sa,show routing route,show session all,test url, packet captures, Prisma Access Insights, and ADEM. - For remote networks, a tunnel that is up but passes no traffic usually points to routing, security policy, NAT, or overlapping subnets.
- Optimization: nearest compute location, App Acceleration, dedicated egress IPs, QoS, right-sized bandwidth licensing, and avoiding unnecessary backhaul.
Worked example
Branch users can reach the internet but not a SaaS application. The IPsec tunnel and BGP are up. Check the route table for the SaaS prefix, the security rule for the branch zone, NAT policy, and session logs. If the route points to the wrong tunnel, correct BGP advertisement or local preference. Why: tunnel health does not prove forwarding; routing and policy are separate layers.
Traps
- Blaming Prisma Access when the ISP or customer edge is failing.
- Overlooking license or bandwidth limits during peak hours.
- Forgetting MTU/MSS issues that only affect large packets.
- Not checking ADEM or Insights before changing configuration.