Prisma SD-WAN Discussions | Palo Alto Networks

Welcome to the Prisma SD-WAN Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

How to check PALO ION system hardware status

Hi Palo Experts, How can I check my ION system hardware status? I am using Strada to manage my devices. I manage to find the remote access button and navigate to CLI, but I am unable to type this command 'show system environmentals', it doesnt even has a command staring with 'show' How can I check ya? any other alternative ways? I just...

Resolved! Prisma SDWAN BGP route redistribution

I have a datacenter ION9k that is connected via standard VPN to AWS. On another connection I have a PA-1400 series firewall. The connections look something like this:PA-1400 (AS 65002) -- DC ION (AS 65003) -- AWS VPN (AS 65417)The ION receives routes from from AWS and from the PA-1400. The problem I'm having is that the ION is not advertising t...

Prisma ION Static Routes into BGP

I notice that Prisma SD-WAN will not advertise static routes into BGP. Sounds like a bug in the software as I found articles discussing this from 1+ years ago. Does anyone know if there is a fix for this. Only way I can see is the LAN side will need to run BGP or OSPF for the redistribution of the routes to happen. I have a TAC Case opened to ge...

Prisma ION log errors

Good morning,Over the past couple of days I've been monitoring the log files on two of our branch ION devices. Looking for any insight into what may be causing this or ow to troubleshoot. It seems to happen to both of them around the same time and the errors scroll nonstop. I've looked at the Datacenter ION but I'm not seeing any correlation and...

SDWAN disconnection after upgrade

Hello, Her is the problem with a disconnect about SDWAN overlay after these action: Uploaded panorama from 10.2.9-h1 to 10.2.10-h7 preferred. Uploaded plugin SDWAN from 3.0.6 to 3.0.8. Committed without error. During push to devices, all devices receive a quick disconnection (around une minute for each firewall, two minutes in total). Didn't ch...

Resolved! Palo Alto SD WAN Setup

Good Morning, Everyone,I'm a Fortigate Expert but completely new on the Palo Alto NGFWs, and I would like to ask you guys if it's possible to configure the SD WAN on a Palo Alto 450 NGFW, without using Panorama.If so, where can I get some documentation to do it? If isn't, which are the steps to get and configure Panorama on my Firewall, to setu...

Saas Quality and Traffic Distribution Profiles in SD-WAN for Dual-ISP

We have a few firewalls with dual-ISP and they all are part of SD-WAN VPN cluster. The goal is to have active-passive ISP links for all traffic to internet (And IPSEC as well), with primary being 1gig fiber, and secondary being asymmetric cable internet. For ISP link fail-over to work, do I need to configure SaaS quality profile as well or j...

Customer Success feature request to produce as-built documentation from Prisma Tenant

I'm currently preparing an as-built document for a customer. I am wondering if Palo Alto Networks Customer Success is working on automating the process of preparing an as-built document by pulling a current Prisma configuration into an as-built template document. With all information located in the controller and AIOps available, this would se...

Resolved! Connection to the controller

GreetingsPlease could you help me with official documentation that indicates the priorities of the ports of the ION 1200, 3200 and 9200 (controller, Lan, WAN, etc.) for the connection to the Strata cloud Manager controller. I need it to standardize the permissions in the firewall and request it from the security team.

need assistance in creating branch to branch and branch-to-DC Secure Fabric tunnels.

HI , need assistance in creating branch to branch and branch-to-DC Secure Fabric tunnels for ION 1000 boxes through (Strata Cloud manager )cloud based.

Zone mapping removed from SDWAN-plugin feature

After reading the release notes for the SDWAN-plugin (3.0.8) and the manual to configure SDWAN (10.2.x), I'm still confused on how I need to migrate from using zone mapping to using the pre-created zones zone-internet zone-to-hub zone-to-branch zone-internal On our branch offices we link every internet-facing interface to the zone "ISP". In ea...

Getting CPU usage metrics from PRISMA SD-WAN using API

I am trying to get the metrics for CPU usage from the API monitor using POST , i am getting IAM_401. My token is valid.. I tried both the methods GET and POST.. POST https://pan.dev/sdwan/api/post-sdwan-v-2-3-api-monitor-sys-metrics/ {'_error': {'code': 'IAM_401', 'message': 'Invalid Request Token.', '_request_id': '71fe893b-2655-452f-9ad3-64317...

Send Traffic to Firewall for Inspection when ION is Data Center WAN Edge

Hi Prisma SD-WAN community, I hope hope you are all keeping well. I’m busy working on a Prisma SD-WAN proposal and architecture, and I’m trying to figure out how I would send traffic to a firewall in the DC for inspection first when the ION is the WAN edge. With the ION being the edge, it would simply just route the traffic out to the Intern...

Connect fail with prisma-access between SD-wan

Hi, it's a good day. We want to create a connection between Prisma-access and SD-wan. (VPN) I'm writing this post because I'm having trouble connecting, whereas before the connection was created without issue. Is there anyone who can help me with this situation? For now, we've created SD-WAN in an HA configuration. I thought that when conne...