Weak Path Affinity

We're looking at some interesting issues around app shift between our Prisma Access tunnel and local/DC breakout. Session starts as SSL, gets pushed over the PA tunnel, gets reidentified as an app that is set to breakout locally and the ION duly changes path and breaks the session. Most apps/devices tolerate this fine, but some refuse to reattem...

SASE API - SD-WAN

So I am playing with the API currently however, I am having an issue trying to find a call where i can specify a SiteID and retrieve all the current overlays on that site. The goal of course is to be able to add/remove overlays(auto VPN) to the sites/ions through API but getting a little bit of a rough start. Any help much appreciated.

Feature Request: Policy Rollback

I couldn't find anywhere if they have a feature request section. I would like a feature that allows you rollback a policy if it goes wrong. The current option is to clone a policy and apply the changes to the cloned policy. While this is functional, it can become challenging if you have a naming convention in place for your path sets. I'd b...

DHCP Scope Mapping to Subinterfaces in Prisma SD-WAN (ION Device)

Hi Community, I’ve configured two DHCP scopes with different IP subnets under the Branch Site configuration in Prisma SD-WAN. On the corresponding ION device, I’ve also created two subinterfaces, each intended for a different VLAN and subnet. I would like to understand:How does the ION device ensure that the correct DHCP scope is applied to th...

Prisma SD-WAN DHCP option 242

Has anyone configured DHCP Option 242 on Prisma SD-WAN ION? I have a use case due to Avaya phones. I want to validate that I have the fields set correctly for the option to work correctly. The KB articles and documentation has not been much assistance. DHCP Option 242 Value = MCIPADD=x.x.x.x,HTTPSRVR=y.y.y.y

troubleshoot DC router

We have deployed Data Center (DC) routers at two distinct U.S. locations, each configured with multiple VRFs to support various service segments. The issue encountered is that despite no spoke sites being operational yet, the DC routers are already receiving route prefixes on one of the VRF and advertising them toward the LAN segment at DC. ...

Setup involving Palo Alto SD-WAN and Cisco FlexConnect APs, understanding the tunnel MTU behaviour

We are currently planning a Cisco FlexConnect wireless AP setup with Palo Alto SD-WAN. as per various reference guides, we observed that when Windows performs certificate-based authentication, it sends large packets with an MTU of 1482 or more. However, the Palo Alto sdwan tunnel size is set to 1432. This raises a concern: when EAP packets are...

Prisma SDWAN ION monitoring

Hi, We have deployed several branches, unfortunately monitoring the branch ION by snmp doesn't seem to work out. Response times of ION's on snmpwalk are high (up to 10sec). We were recommened to use api monitoring instead. I've generated auth keys etc and can querry SCM (api.strata.paloaltonetworks.com......). Unfortunately I cannot find any ...

With App Probes Disabled, ION still sending probes

On both IONs assigned to the site, I have disabled application reachability probes from the device "Basic Info" radio button. Confirmed via CLI probes are still being sent Traffic logs also confirm probes are being sent Is there anything else needed to fully disable the probes from being sent? Also is there anything to help understand th...

Cisco 10G SFP+ DAC from ION 5200 to Nexus 9K

Hoping someone can help me understand whether using a Cisco 10G SFP+ DACs between an ION 5200 appliance and Nexus 9K switching can work. Cisco SKU is SFP-H10GB-CU2M. ION is recognizing the DAC at the ports, but not coming online. Prisma SD-WAN

Software Release Guidance for Prisma SDWan Ion Devices

To any of you using the Cloudgenix Ion devices, do you have any version upgrade recommendations or best practices? Is anyone running 6.x successfully or are most staying with an older supported release like 5.6? End-of-Life Summary - Palo Alto Networks I had all our devices (Ion 3k,7k, 9ks) on 5.6.5-b15 which we didn't have too many problem...

How to check which IP is utilizing more bandwidth in SDWAN ION portal or strata portal?