Operations, Monitoring, and Troubleshooting
Operations, Monitoring, and Troubleshooting
This domain tests day-two operations: log visibility, health monitoring, HA behavior, packet-level troubleshooting, and automation. The exam expects you to follow evidence from policy match to route to session to log, not to guess.
Core rules
- Know the log types: traffic, threat, URL, WildFire, decryption, authentication, and system. A session can appear in traffic logs while a threat log records the profile action.
- Use session detail to see the matched rule, NAT translation, application, user, and bytes. Use test security-policy-match and test routing fib-lookup before changing configuration.
- For packet problems, use packet capture and debug dataplane packet with filters; check global counters for drops, resource limits, and HA state.
- Monitor HA with path monitoring and link monitoring; verify the passive device has synchronized configuration and sessions when stateful failover is required.
- Forward logs to Cortex Data Lake, Panorama, or syslog, and alert on WildFire verdicts, threat spikes, decryption failures, and HA transitions. Use the API for repeatable checks.
Worked example
A user reports a SaaS app timing out. Check the traffic log: if no session appears, verify DNS, route, and whether the packet reaches the firewall. If a session is denied, run test security-policy-match with the actual source, destination, application, and user. If allowed but reset, inspect session detail for NAT and security profiles. If App-ID shows 'ssl' or 'unknown', check decryption policy and certificate trust. Reason: each step isolates a different layer: routing, policy, inspection, or application.
Traps
Reading only traffic logs; ignoring threat and URL logs; assuming the passive HA device logs identically; missing NTP or timezone skew; overlooking log-forwarding quotas; and restarting services before capturing evidence.