Prisma Access Troubleshooting Guide#

Diagnose and resolve common Prisma Access issues via Strata Cloud Manager.

How to Use#

Describe the issue in $ARGUMENTS, or let this skill guide you through interactive troubleshooting.

Troubleshooting Areas#

1. GlobalProtect Connectivity Issues#

Symptoms: Users cannot connect, connection drops, slow connections

Diagnostic Steps:

1. Check portal/gateway status via SCM API: text

   GET /sse/config/v1/mobile-agent/portals?folder=Mobile Users
   GET /sse/config/v1/mobile-agent/gateways?folder=Mobile Users
   
   

2. Verify authentication profile configuration

3. Check HIP profile requirements vs client compliance

4. Review split tunnel configuration

5. Check DNS resolution for portal/gateway FQDNs

6. Verify certificate chain (portal cert, gateway cert, CA cert)

Common Causes:

• Expired or misconfigured certificates
• SAML IdP unreachable or misconfigured
• HIP check failures (disk encryption, antivirus, OS version)
• DNS resolution failures
• MTU/fragmentation issues
• ISP blocking UDP 4501 (IPSec) — check for TCP fallback

2. Security Policy Not Matching#

Symptoms: Traffic allowed when it should be blocked, or blocked when it should be allowed

Diagnostic Steps:

1. Export and review rule ordering: text

   GET /sse/config/v1/security-rules?folder=Prisma Access&position=pre
   GET /sse/config/v1/security-rules?folder=Prisma Access&position=post
   
   

2. Check for shadow rules (broader rules preceding specific ones)

3. Verify source/destination zone assignments

4. Confirm App-ID identification (check for SSL decryption)

5. Review address object resolution (FQDN objects, dynamic groups)

6. Check user-to-IP mapping for user-based rules

Common Causes:

• Rule ordering: more specific rules after broader rules
• Missing SSL decryption: App-ID cannot identify encrypted traffic
• Zone confusion: Mobile Users vs Remote Networks vs Service Connections
• Stale FQDN resolution
• User-ID mapping delays or failures

3. Configuration Push Failures#

Symptoms: Config changes not taking effect, push job errors

Diagnostic Steps:

1. Check candidate config status: text

   POST /sse/config/v1/config-versions/candidate:push
   
   

2. Monitor push job status: text

   GET /sse/config/v1/jobs/{job-id}
   
   

3. Review job error details for specific validation failures

Common Causes:

• Reference errors: rules reference deleted or renamed objects
• Duplicate names: objects with same name in different folders
• Invalid values: out-of-range ports, malformed IP addresses
• Dependency conflicts: circular references between objects
• Concurrent edits: another admin pushed changes simultaneously

4. Remote Network / Service Connection Issues#

Symptoms: Tunnel down, BGP not establishing, routes not propagating

Diagnostic Steps:

1. Check tunnel status via SCM
2. Verify IKE/IPSec configuration matches on both ends:
   • IKE version, DH group, encryption algorithm, hash algorithm
   • Pre-shared key or certificate authentication
   • Local and peer IDs
3. Review BGP configuration:
   • AS numbers, peer IP addresses, route advertisements
   • MD5 authentication
4. Check for overlapping IP ranges between sites

Common Causes:

• IKE/IPSec parameter mismatch with on-prem device
• Pre-shared key mismatch
• BGP peer address not in the same subnet
• Firewall blocking IKE (UDP 500/4500) on the on-prem side
• Overlapping IP address spaces between sites

5. SCM API Errors#

Symptoms: API calls returning errors

Common Error Codes and Solutions:

CodeErrorSolution400Invalid ObjectCheck JSON payload format; verify all required fields401Authentication ErrorToken expired — re-authenticate with OAuth2403Authorization ErrorCheck role-based access; verify TSG ID permissions404Object Not FoundVerify object name and folder parameter409ConflictObject already exists; use PUT to update instead of POST429Rate LimitBack off and retry; implement exponential backoff500Internal ErrorRetry after 30 seconds; check SCM service status504Gateway TimeoutRetry; consider breaking large operations into batches

6. Performance and Latency Issues#

Diagnostic Steps:

1. Check bandwidth allocation per region
2. Review QoS policy configuration
3. Verify closest service edge location
4. Check for suboptimal routing (hairpinning through distant regions)
5. Review concurrent session counts vs license limits

Diagnostic Approach#

When the user reports an issue:

1. Identify the category from the areas above
2. Gather information: ask for specific error messages, affected users/sites, timeline
3. Check configuration: use SCM API to review relevant configuration
4. Identify root cause: compare configuration against best practices
5. Provide fix: give specific SCM API calls or configuration changes to resolve
6. Verify: provide steps to confirm the fix worked