Prisma Access: Operations, Monitoring & Troubleshooting

Effective operation of Prisma Access relies on proactive monitoring, robust logging and reporting capabilities, efficient troubleshooting methodologies, and a clear understanding of the update processes. This document covers these critical operational aspects.

Part 1: Monitoring Prisma Access Health

Regularly monitoring the health and performance of your Prisma Access deployment is crucial for identifying potential issues before they impact users and for ensuring optimal service delivery.

Using the Prisma Access Insights Dashboard

• Primary Tool: Prisma Access Insights is the central dashboard for monitoring. It's integrated into the Prisma SASE Cloud Management UI and accessible via the Hub. Panorama users also rely heavily on Insights via the Hub, though some status is visible in the Cloud Services plugin.
• Key Sections/Dashboards:
  • Summary/Overview: Provides a high-level view of service status, active users/sites, bandwidth usage, alerts, and top threats.
  • Mobile Users: Monitors connectivity, authentication, latency, bandwidth usage per user, location, OS, and GlobalProtect version.
  • Remote Networks: Tracks tunnel status (IPSec/BGP), latency, jitter, packet loss, bandwidth utilization per site, and configuration status.
  • Service Connections: Similar metrics to Remote Networks, focused on datacenter connectivity.
  • Alerts: Centralized view of triggered alerts based on configured thresholds.
  • Security: Dashboards visualizing threat activity, URL filtering trends, WildFire submissions, etc.
• Data Source: Insights primarily visualizes telemetry and log data collected by Prisma Access and stored in Cortex Data Lake.
• Time Range Selection: Allows analyzing trends over different time periods (e.g., last hour, 24 hours, 7 days).

Key Metrics to Monitor

• Connectivity Status:
  • Tunnel Status (RN/SC): Up/Down status for IPSec and BGP sessions. Frequent flaps indicate instability.
  • Mobile User Connections: Number of active users, successful vs failed connection attempts.
• Performance Metrics:
  • Latency: Round-trip time between user/site and Prisma Access PoP, and potentially to application destinations. High latency impacts user experience. Monitor average and peak latency per location/user.
  • Jitter & Packet Loss (RN/SC): Especially important for real-time applications (VoIP/Video). High jitter/loss indicates network instability, often on the local ISP link.
  • Bandwidth Utilization: Monitor aggregate and per-site/user bandwidth usage against licensed limits. High sustained utilization may require upgrades or QoS.
• Resource Utilization (Prisma Access Infrastructure): While managed by Palo Alto Networks, Insights may provide indicators of SPN or other infrastructure health/load, though direct resource metrics are generally abstracted. Palo Alto Networks SRE teams monitor the backend infrastructure.
• Threat Activity: Top threats detected (malware, C&C, phishing), blocked URLs, WildFire verdicts. Spikes may indicate targeted attacks or outbreaks.
• Authentication Failures: High rates of GlobalProtect login failures can indicate IdP issues, credential problems, or configuration errors.
• HIP Compliance Status: Monitor the number of compliant vs non-compliant devices connecting.

Alerting Configuration

• Purpose: Proactively notify administrators about critical events or threshold breaches.
• Configuration Location: Typically configured within Prisma Access Insights (via the Hub/Prisma SASE UI).
• Configurable Alerts (Examples):
  • Tunnel Down (RN/SC)
  • BGP Peer Down (RN/SC)
  • High Latency Threshold Exceeded
  • High Bandwidth Utilization (Aggregate or Per-Site)
  • High Packet Loss/Jitter
  • Excessive Authentication Failures
  • Critical Threat Detections
  • License Usage Nearing Limit
  • Infrastructure/Service Degradation Events (often notified by Palo Alto Networks directly via status page/email as well)
• Notification Methods: Email, Webhooks (for integration with tools like Slack, PagerDuty), SNMP Traps (via Panorama if configured).
• Best Practice: Configure alerts for key failure conditions (tunnels, BGP) and critical performance thresholds. Avoid overly noisy alerts. Tune thresholds based on baseline performance.

Part 2: Logging and Reporting

Prisma Access leverages Cortex Data Lake (CDL) for centralized, scalable logging. Accessing and interpreting these logs is vital for troubleshooting, security analysis, and compliance reporting.

Querying Logs in Cortex Data Lake

• Access Methods:
  • Panorama Monitor Tab: Familiar interface for Panorama users. Provides querying, filtering, and predefined views for various log types (Traffic, Threat, URL, etc.) stored in CDL.
  • Prisma SASE UI (Monitor): Cloud-managed interface offers similar log viewing and filtering capabilities.
  • Prisma Access Insights: Uses CDL data but presents it in aggregated, dashboard-focused views rather than raw log lines.
  • Cortex XDR Console (Explore): If using Cortex XDR, its 'Explore' feature provides powerful querying (using XQL) directly against CDL data.
  • Cortex Data Lake App (Hub): Provides direct access to query logs using specific syntax, manage log forwarding, and view storage consumption.
• Filtering and Querying:
  • Use the filter builders provided in Panorama/Cloud UI.
  • Construct queries using logical operators (AND, OR, NOT) and specific field values (e.g., (addr.src in 10.1.1.5) and (action eq deny)). Syntax varies slightly depending on the tool (Panorama filters vs XQL).
  • Filter by time range, log type, source/destination IP, user, application, action, threat type, URL category, etc.

Conceptual Log Query Process

flowchart TD
    A[Admin Needs Info] --> B{Choose Access Method};
    B -- Panorama --> C[Panorama Monitor Tab];
    B -- Cloud UI --> D[Prisma SASE Monitor];
    B -- XDR --> E[Cortex XDR Explore];
    B -- Hub --> F[CDL App Query];

    subgraph Query Interface
        C --> G{Build Filter / Query};
        D --> G;
        E --> G;
        F --> G;
    end

    G -- Query Sent --> H((Cortex Data Lake));
    H -- Log Results --> I{Display Results};

    subgraph Results Display
        C --> I;
        D --> I;
        E --> I;
        F --> I;
    end

    I --> J[Admin Analyzes Logs];

     

Using Predefined and Custom Reports

• Panorama Reporting:
  • Predefined Reports: Offers numerous built-in reports for traffic summaries, threat analysis, URL activity, user activity, VPN usage, etc. (accessible via Panorama > Monitor > Manage Custom Reports).
  • Custom Reports: Allows creating tailored reports based on specific log types, filters, grouping criteria, and timeframes.
  • Report Groups: Schedule generation and emailing of multiple reports.
• Prisma Access Insights: While dashboard-focused, Insights essentially provides predefined, interactive reports on various aspects of the service. Data can often be exported.
• Cloud Management UI: May offer built-in reporting capabilities similar to Panorama's predefined reports.
• Use Cases: Compliance reporting, security posture summaries, usage trend analysis, executive summaries.

Interpreting Different Log Types

• Traffic Logs: Show session start/end information. Key fields: Source/Destination IP/Port/Zone/User, Application (App-ID), Rule Matched, Action (allow/deny/drop), Bytes Sent/Received, Session End Reason. Essential for connectivity troubleshooting.
• Threat Logs: Detail detected threats. Key fields: Threat Type (virus, spyware, vulnerability, wildfire), Severity, Action Taken (alert, block, sinkhole), Source/Destination IP/User, Threat Name/ID, URL (if applicable). Crucial for security incident analysis.
• URL Filtering Logs: Show web activity. Key fields: Source IP/User, Destination URL, URL Category, Action (allow, block, continue, override), Rule Matched. Used for web usage analysis and troubleshooting web access issues.
• User-ID Logs: Track IP-to-User mappings learned via GP login, SAML, etc., and group mapping events. Key for verifying user identification and group membership used in policies.
• GlobalProtect Logs (System Logs): Show GP Portal/Gateway events - successful/failed logins, authentication details, HIP check results, tunnel establishment events. Filter by `(subtype eq globalprotect)`. Vital for MU connection issues.
• Tunnel Logs (System Logs): Show IPSec IKE and IPSec negotiation events for RN/SC tunnels. Filter by `(subtype eq vpn)`. Essential for site-to-site VPN troubleshooting. Look for Phase 1 / Phase 2 success or failure messages.
• System Logs: General device/service health messages, including BGP peering events (`subtype eq routing`), configuration changes, hardware/software events (though much infrastructure is managed by PANW).
• Configuration Logs: Audit trail of configuration changes made via Panorama or Cloud UI, showing who changed what and when.
• DNS Security Logs (Threat Logs): Show DNS queries identified as malicious. Look for Threat Type `dns`.
• DLP Logs: Show detected data pattern matches and actions taken (requires DLP license and configuration).

Part 3: Troubleshooting Common Issues

A systematic approach is key to resolving issues efficiently.

Mobile User Connectivity Problems

Remote Network Tunnel Down Issues