SD-WAN Monitoring, Troubleshooting, and Operations
Domain 4: SD-WAN Monitoring, Troubleshooting, and Operations
This domain tests day-two operations: reading Prisma SD-WAN Command Center dashboards, using flow and path-quality data, interpreting alarms, capturing packets, and running change/upgrade workflows. The goal is to isolate whether a fault is underlay, overlay, policy, or application.
Core rules
- Start at the right scope: site, device, interface, circuit, tunnel, or application flow. A site-wide alarm differs from a single ION interface issue.
- Command Center monitoring includes device health, interface/tunnel status, path quality (latency, jitter, loss), top talkers, flow browser, events, and alarms.
- Flow Browser shows which application policy and path a flow used; use it before changing policy.
- Path-quality violations trigger failover only if the policy has an eligible alternate path and the SLA profile matches the traffic.
- Operations include controller-managed software upgrades, configuration audit, syslog/SNMP/NetFlow export, and device toolkit actions such as ping, traceroute, and packet capture.
- ADEM adds end-to-end user-experience telemetry for SASE and SaaS paths, complementing device-centric metrics.
Worked example
Users at one branch report slow Microsoft 365, but internet tests are normal. Open Flow Browser, filter the branch and application, and see the flow using MPLS with 180 ms latency; the path-quality profile threshold is 100 ms. The application policy should have selected broadband breakout, but the SaaS rule is below a broad any-any rule, so the default path wins. Move the SaaS rule above the broad rule and confirm the next flow uses broadband and meets SLA. If tunnels are down, check underlay IP, DNS, and controller reachability first.
Traps
Do not troubleshoot policy before confirming interface and tunnel health. Do not confuse an alarm with an event. Do not capture on the WAN interface when the suspect flow is LAN-to-LAN. Do not assume failover occurs without an eligible alternate path. Do not ignore asymmetric routing when return traffic uses a different circuit.