Palo Alto Prisma insights

Total performance policy rules multiplied by application IDs per rule exceeding platform limits (e.g., 150 for ION 1000, 1275 for larger models) causes rule processing failures and unpredictable policy behavior.

When the number of VPNs actively invoking Forward Error Correction reaches platform limits (e.g., 8 for ION 1000/1200, 64 for ION 9000), no additional VPNs can encode/decode recovery information, leaving applications vulnerable to packet loss.

When paths exceed packet loss, latency, or jitter thresholds defined in Path Quality Profile, applications become Impacted and no paths meet SLA requirements, triggering Forward Error Correction or path switching.

ION devices disconnecting from the controller trigger multiple downstream incidents including VPN failures, process restarts, and connectivity loss. This creates a monitoring blind spot and potential service outage.

High disk utilization (DEVICEHW_DISKUTIL_PARTITIONSPACE) requires immediate investigation of attached volumes and disk space consumption, potentially leading to device operational failures.

High memory utilization causing swap space usage (DEVICEHW_MEMUTIL_SWAPSPACE) indicates resource exhaustion that can severely degrade ION device performance.

Concurrent flow limits exceeded (DEVICESW_CONCURRENT_FLOWLIMIT_EXCEEDED or DEVICESW_FPS_LIMIT_EXCEEDED) indicate potential network scanning, DDoS activity, or undersized ION device for traffic volume.

Endpoint agents running outdated versions (shown in endpoint_gp_version) may have security vulnerabilities, feature gaps, or compatibility issues requiring selective upgrade outside normal rollout.

When authentication or gateway selection fails, troubleshooting logs show attempted gateways, SSL response times, and connection errors. High SSL response times or gateway priority misconfigurations can cause user connectivity failures.

Connection status between Prisma Access SPNs (MU-SPN or RN-SPN) and Strata Logging Service shows Down, indicating logs are not being received from affected locations and creating visibility gaps.

External Dynamic Lists (EDLs) not refreshing on schedule create security risks as IP addresses, URLs, or threat intelligence become outdated, potentially allowing blocked entities through or blocking legitimate traffic.

When Prisma SD-WAN and Prisma Access have different TSG IDs or are not in the same region, the Cloud Managed CloudBlade fails association with error code FAWKES_PA_TENANT_NOT_FOUND, breaking integration.