SD-WAN-Engineer Palo Alto Networks SD-WAN Engineer Questions and Answers

Comprehensive and Detailed Explanation

Prisma SD-WAN utilizesSTUN (Session Traversal Utilities for NAT)to facilitateNAT Traversalfor its Secure Fabric overlay.

Discovery:When an ION device connects to the internet behind a NAT router, it reaches out to the Prisma SD-WAN Controller. The controller acts as a STUN server, identifying thepublicIP address andportthat the ION's traffic is originating from.

Symmetric NAT Challenge:In Symmetric NAT, the mapping changes for every destination. However, the Prisma SD-WAN architecture is designed to handle this by having the controller coordinate the connection attempt.

Hole Punching:The controller shares the discovered public mapping information between two peer ION devices. They then simultaneously initiate traffic to each other's public IP/Port (a technique called "UDP Hole Punching"). This tricks the intermediate NAT devices into allowing the inbound traffic, establishing a direct P2P IPSec tunnel without requiring manual port forwarding or static IPs at the edge.

Comprehensive and Detailed Explanation

According to Palo Alto Networks Prisma SD-WAN administrator documentation regarding Path Policy configuration, specific rules apply when utilizingStandard VPNs(IPSec tunnels to non-ION devices, such as Prisma Access or third-party firewalls) as anL3 Failure Path.

When a Path Policy rule is configured, the administrator defines Active Paths, Backup Paths, and L3 Failure Paths. The L3 Failure Path is a "last resort" mechanism used when all Active and Backup paths are unavailable (Layer 3 down).

If Standard VPN is selected as the L3 Failure Path type, the system explicitly requires that the administrator also associates it with a specific Standard Services and DC Group within that same policy rule.

The ION device uses theStandard Services and DC Groupto identify the specific remote endpoint (tunnel destination) where the traffic should be routed. Unlike a "Direct" (Internet) path which can simply route out to the WAN, a Standard VPN represents a logical tunnel. If the policy rule designates "Standard VPN" as the failure path but leaves the "Standard Services and DC Group" field empty or unselected, the ION effectively has a directive to "use a VPN" but lacks the instruction onwhichVPN group to use for this specific application context. Consequently, even if the IPSec tunnel to Prisma Access is physically up and stable, the policy engine cannot resolve the next hop for the "SuperSaaSApp" traffic, resulting in the packets being dropped. To resolve this, the administrator must edit the Path Policy rule to ensure the specific Standard Service/DC Group representing Prisma Access is checked/selected for the L3 Failure Path.

Comprehensive and Detailed Explanation

In Prisma SD-WAN routing configuration, theScopesetting on a BGP Peer (or a Static Route) controls the redistribution logic for the prefixes learned from that source.

Local Scope:If a BGP peer is configured with "Local" scope, the ION device will install the learned routes into itslocalrouting table for its own reachability, but it willnotadvertise (redistribute) these routes to other ION devices via the Secure Fabric. They remain local to the site.

Global Scope:To advertise reachability to the rest of the network, the BGP peer must be configured with"Global"scope. This tells the ION that any prefixes learned from this specific neighbor (e.g., the DC Core Switch) should be propagated across the SD-WAN overlay to remote branches. This is the critical setting for enabling branch-to-DC communication for applications hosted behind that BGP peer. Without "Global" scope, the branches would never learn the routes to the data center subnets.

Comprehensive and Detailed Explanation

TheION Device Data Plane(the software running locally on the hardware appliance at the branch) is the component responsible for the heavy lifting of traffic analysis.

Edge Processing:Prisma SD-WAN uses an "Application-Defined" architecture. The ION device performsDeep Packet Inspection (DPI)on the first few packets of a flow to identify the application (e.g., distinguishing "Skype Video" from "Skype Chat").

Metric Calculation:The ION device timestamping engine calculates the performance metrics (RTT, NTT, SRT) in real-time as packets pass through its interfaces. It aggregates this metadata.

Role of Controller (B):The Controllercollectsandvisualizesthis data (Analytics), but it does notgenerateit. The Controller does not sit in the data path of the user traffic. If the ION relied on the controller for App-ID, latency would be unacceptably high. Therefore, all detection and metric generation happens locally on theION Device.

Comprehensive and Detailed Explanation

The best practice for managing upgrades in a large-scale Prisma SD-WAN environment is theCanary or Phased Rolloutapproach, utilizingSite Tags.

Risk Mitigation:Upgrading all sites simultaneously (Option B) is highly risky. If the new software version has an unforeseen bug or compatibility issue with a specific circuit type, the entire network could face an outage.

Tag-Based Management:Administrators should create tags such as "Upgrade-Phase-1" (Pilot sites) or "Region-North". By assigning the specific Software Version to theTag(rather than the individual site or the global default), the controller pushes the update only to that subset of devices.

Procedure:

Apply update to "Pilot" tag (5 sites). Monitor for 24-48 hours.

Apply update to "Region-1" tag (50 sites). Monitor.

Eventually, update the Global default once confidence is high.

Option A is unscalable, and Option D is incorrect as the administrator retains full control over when upgrades occur; they are not forced automatically without policy configuration.

Comprehensive and Detailed Explanation

TheCloudBladeplatform is a distinguishing architectural component of the Prisma SD-WAN solution. It isnota physical piece of hardware, nor is it software that runs directly on the branch ION device's CPU.

Instead, the CloudBlade platform is acloud-based API integration layerhosted by Palo Alto Networks. It functions as an intelligent broker or "translator" between the Prisma SD-WAN Controller and external third-party services (such as Prisma Access, Amazon Web Services, Azure, ServiceNow, or Zscaler).

When an administrator configures thePrisma Access CloudBlade, for example, they input their API credentials and intent (e.g., "Connect all US branches to US West"). The CloudBlade engine then:

Communicates with the Prisma Access API to provision the remote IPSec termination nodes (Security Processing Nodes).

Translates this configuration into specific instruction sets for the Prisma SD-WAN Controller.

The Controller then pushes the necessary VPN tunnel configurations, IKE parameters, and routing rules to the relevant ION devices.

This architecture eliminates the need for manual IPSec configuration on every branch device. It ensures that if the third-party service changes its IP addresses or settings, the CloudBlade can detect the change via API and automatically update the branch fleet, maintaining connectivity without manual administrator intervention.

Comprehensive and Detailed Explanation

TheSITE_CONNECTIVITY_DOWNalarm is a high-severity alert indicating a total loss of overlay connectivity for a site.

It doesnottrigger if justonecircuit fails (Option B), provided that other circuits are still up and maintaining VPNs. A single link failure would typically trigger a "Link Down" or "VPN Down" alarm, but theSiteconnectivity would remain "Up" (degraded).

It does not simply mean the device rebooted (Option A), although a reboot would cause it temporarily; the alarm specifically tracks the state of the VPN fabric.

The SITE_CONNECTIVITY_DOWN alarm specifically generates when all Secure Fabric Links (VPN tunnels) on the device are in the "Down" state. This means the branch is completely isolated from the rest of the SD-WAN network (Data Centers and other branches), even if the device itself might still be powered on and reachable via the controller (management plane). It signifies a "Blackout" of the data plane for that location.

Comprehensive and Detailed Explanation

The transition from "Claimed" to "Online" depends entirely on the ION device's ability to establish a secure, persistent management tunnel to the Prisma SD-WAN Controller.

Connectivity Requirements:The ION device initiates an outbound connection to the controller onTCP Port 443 (HTTPS). It also requires accurate time synchronization to validate SSL certificates, necessitating access toNTP (UDP Port 123).

Scenario Analysis:Since the installer can browse the internet from the LAN, we know the physical link and basic routing/NAT are functional. The issue is specific to themanagement planetraffic.

Root Cause:If an upstream firewall (e.g., a corporate edge firewall or ISP filter) is inspecting SSL traffic or blocking specific FQDNs/Ports required by the ION, the device cannot complete the handshake. Consequently, it remains "Claimed" (registered in the database) but cannot go "Online" (active management session). Options A, C, and D preventprovisioning(configuration push) but generally do not prevent the device from initially checking in and going "Online" if the pipe is open.

Comprehensive and Detailed Explanation

To defend against volumetric attacks such asTCP SYN Floods, UDP Floods, or ICMP Floods, Prisma SD-WAN (like PAN-OS) utilizesZone Protection Profiles.

Function:A Zone Protection Profile is a specific security object designed to screen traffic for protocol anomalies and flood behaviors before it is processed by the complex firewall policy engine. It sets thresholds (e.g., "Max 1000 SYNs/sec"). If the traffic rate exceeds this threshold, the system triggers an action (Alarm, Drop, or SYN Cookies) to protect the device's resources.

Application:Unlike a standardZBFW Rule(A) which filters based on Source/Destination/App-ID (which might still allow the initial handshake packets that cause the flood), a Zone Protection Profile is applied to theZoneobject itself (in this case, theLAN Zone). This ensures that the flood is mitigated at the ingress stage, preventing the ION's session table and CPU from being exhausted by the attack.

Comprehensive and Detailed Explanation

This behavior describes the"Best Available Path"logic inherent in Prisma SD-WAN's availability design.

SLA Thresholds:Path Quality Profiles act asfiltersto identify compliant paths.

Total Violation:Ifallconfigured "Active" paths violate the SLA (e.g., Path A has 2% loss, Path B has 5% loss, and the threshold is 1%), the system does not drop the traffic (Option A) because maintaining connectivity is prioritized over perfect quality.

Selection Logic:The system enters a fallback state where it compares the available active paths and selects the"Least Bad"one—the path that isclosestto meeting the SLA (in this case, Path A with 2% loss).

Backup Paths:Traffic would only move to aBackuppath (Option D) if the policy explicitly configures the backup path to engage upon SLA violation of the active set. However, strictly speaking, ifonlyactive paths are considered and all fail, it picks the best of the active group rather than blackholing the traffic.

Comprehensive and Detailed Explanation

The Prisma SD-WAN (CloudGenix) solution is designed with a separation of the control plane (Controller) and the data plane (ION devices).1In the event that an ION device loses connectivity to the Cloud Controller (often referred to as running in "headless mode"), the device continues to forward traffic and maintain existing VPN tunnels using the keys it currently holds.2

However, for security purposes, theVPN session keys(shared secrets) used for the Secure Fabric have a finite validity period. The system is designed such that these keys are rotated regularly.3If the controller is unreachable, the ION device can continue to rotate keys locally and maintain the VPNs for a maximum default period of72 hours(exactly3 days).4

If the connection to the controller is not restored within this 72-hour window, the keys will eventually expire, and the ION will be unable to retrieve new authorized key material from the controller.5Consequently, the VPN tunnels will go down, and the "out of shared secret key" error will be observed in the VPN status logs. This mechanism ensures that a permanently compromised or stolen device cannot maintain network access indefinitely without central authorization.

Comprehensive and Detailed Explanation

This scenario depicts a High Availability (HA) topology utilizing theION 1200-Smodel'sFail-to-Wire (bypass)capabilities to share WAN links between two devices without needing external switches for every WAN connection.

1. WAN Link Availability (Statement A):

The diagram illustrates a "daisy-chain" cabling method supported by the ION 1200-S bypass pairs.

ISP A (Green):Connects directly to the "Standby" (Left) unit first. Since the Standby unit remains powered on, it maintains direct access to ISP A.

LTE/5G (Blue):Connects to the "Active" (Right) unit first. The connection then loops through a bypass pair on the Active unit to the Standby unit. When power is removed from the "Active" unit, thefail-to-wire relayson its Ethernet ports close physically. This creates a passive electrical bridge that connects the LTE modem directly to the Standby unit. The Standby unit (now becoming Active) will detect the link state change and successfully utilize the LTE connection. Therefore, both WAN links remain usable.

2. LAN Failover Mechanism (Statement C):

Prisma SD-WAN ION devices typically use a VRRP-like mechanism for LAN redundancy.

When the "Active" node fails (loses power), the "Standby" node stops receiving keepalives and promotes itself to the Active state.

To ensure downstream switches and clients immediately send traffic to the new Active unit, it must update their ARP tables. It does this by broadcasting aGratuitous ARP (GARP)packet for the Virtual IP (VIP) address of the Switch Virtual Interfaces (SVIs). This action informs the network that the MAC address associated with the Gateway I1P is now reachable via the port connected to the new Active ION.234