Operations, Monitoring, and Troubleshooting
Where the evidence lives
There is no customer-accessible firewall CLI on Prisma Access infrastructure. You troubleshoot from Strata Cloud Manager - Insights, Command Center, Alerts - and from Strata Logging Service. Insights covers mobile users, remote networks, service connections and application experience; Command Center shows tunnel and BGP state per location; logs only exist where forwarding was configured.
A repeatable ladder
- Scope the symptom: one user, one branch, one application, or everyone.
- Mobile user: did IdP authentication succeed, did HIP pass, did the device get an address from the pool, which gateway did GlobalProtect select?
- Remote network or service connection: IKE SA up, IPSec SA up, BGP established and prefixes exchanged both ways, bandwidth allocated.
- Policy: the traffic log names the matching rule and the session end reason.
- Performance: is the application reached locally at the compute location, or hairpinned through a service connection?
Worked example
Ten users in Singapore report slow SaaS. Their GlobalProtect logs show a European gateway. The compute location chosen at onboarding was Europe and Singapore had no allocated bandwidth. Fix: allocate bandwidth in the Singapore compute location and re-order the location list, then have users reconnect. The give-away is that the latency is uniform across users and independent of which application they open.
Traps
- Hunting traffic logs in Panorama when nothing was ever forwarded to Strata Logging Service.
- Reading "allow" as healthy while bytes received stay at zero - that is a return-path or routing fault.
- Escalating to support before checking for a pending or failed commit; many "it changed by itself" reports end there.
- Diagnosing slow SaaS from the firewall policy when the gateway location explains it entirely.