Prisma SD-WAN Traffic Using the Wrong Link: Path Policy Troubleshooting Matrix

A branch has two healthy circuits, yet an application keeps using the link you did not expect. Before changing circuit priorities, separate three questions: did the intended rule match, was the preferred path eligible, and what did the configured selection mode actually optimize? This troubleshooting matrix is designed to answer those questions without turning a narrow application issue into a branch-wide routing change.

Scope: Prisma SD-WAN ION path policies, not PAN-OS Policy-Based Forwarding or the separate PAN-OS SD-WAN plugin. The tables below are original operational worksheets, not recorded customer incidents. Device tests are proposed, not executed. The current Administrator’s Guide is the reference for policy controls; the older Dynamic Path Selection paper supplies background on affinity and session behavior, not a universal description of every newer selection mode.[2][1]

X Follow @ipexptobe

InfiniBand P_Key Troubleshooting: 256-GPU Partition Design and Test Matrix

An InfiniBand link can be active while the application is still unable to reach its peers. For a shared AI cluster, the useful question is not simply “is the fabric up?” It is “which workload ports should communicate, through which partition, and can we prove the unwanted paths are blocked?” This guide provides a partition inventory worksheet, a worked 256-GPU example and a deployment test matrix.

Scope: this is a hypothetical design and an unexecuted fabric configuration example, not a benchmark or a validated production deployment. The worksheet arithmetic was executed locally. Configuration behavior is grounded in the version-pinned NVIDIA MLNX_OFED documentation and the UFM documentation linked below; confirm the corresponding behavior on your installed release.

X Follow @ipexptobe

Prisma SD-WAN LTE Failover Not Working: Brownout Troubleshooting Matrix

A branch application becomes unusable, but the cellular circuit stays idle. Before changing timers or forcing traffic onto LTE, answer a narrower question: is cellular meant to rescue poor application performance, or only loss of the permitted primary paths? Those are different acceptance tests.

Palo Alto Networks' published SaaS example deliberately keeps metered 5G in the Layer 3 Failure Paths list: that example uses cellular when all active paths are down, not merely degraded.[2] This guide turns that distinction into an original troubleshooting matrix, policy worksheet and controlled failover test plan.

X Follow @ipexptobe

Prisma SD-WAN Branch Migration Checklist: Circuits, Cutover and Rollback

A branch cutover should finish with proven application paths, not just an online SD-WAN appliance. This Prisma SD-WAN migration checklist gives you a circuit worksheet, staged change procedure, acceptance matrix and rollback decision tree to adapt before moving production cables.

Scope: an original planning template for an existing branch moving to Prisma SD-WAN ION devices. The example is hypothetical, not a tested deployment or a universal configuration. Match every platform-specific step to your ION model, software release and approved topology. Keep actual circuit identifiers, addresses and configuration exports in your private change record.

X Follow @ipexptobe

BGP Max-Prefix and Prefix-Limit: Stop Route Leaks Before They Take Down Peering

BGP max-prefix and vendor-specific prefix-limit features are simple controls that prevent a small mistake from becoming a route-leak outage. They are not a replacement for route policy, but they are one of the fastest guardrails to deploy on internet edge, partner, WAN, route-reflector and data-center border sessions.

The practical question is not “should we configure a limit?” It is “what number should we use, where should the session shut down, and how do we avoid making troubleshooting worse during an incident?” This article gives a safe workflow you can apply to eBGP and iBGP neighbors without publishing real customer details.

X Follow @ipexptobe

Management Plane Security: Practical Guide for Network Engineers

Management plane security is the quiet control layer that decides who can log in to routers, switches, firewalls, controllers and network automation systems. It is less visible than routing protocols or packet forwarding, but it often becomes the first thing engineers investigate after a password spray, exposed SSH service, failed audit, or unexpected configuration change.

A useful way to think about the management plane is simple: if the data plane carries customer or application traffic, the management plane carries trust. It includes SSH, console access, HTTPS portals, NETCONF/RESTCONF APIs, SNMP, telemetry collectors, AAA servers, backup tools, jump hosts and privileged automation tokens. When this layer is weak, even a perfectly designed BGP, OSPF, EVPN or MPLS network can be changed by the wrong person or the wrong script.

X Follow @ipexptobe

BGP Communities: The Small Routing Tag That Powers Large Service Provider Networks

When people learn BGP, they usually focus on prefixes, AS_PATH, Local Preference, MED, route-maps, and filtering. These are all important topics, but there is one BGP feature that often looks simple at first and later turns out to be one of the most powerful tools in real-world networks.

That feature is BGP Communities.

X Follow @ipexptobe

BGP Prefix Lists: Practical Guide for Network Engineers

BGP prefix lists are a precise way to filter routes by prefix and mask length on Cisco IOS. This note keeps the original examples and adds a short structure for engineers reviewing route-policy behavior.

Cisco IOS BGP prefix-list syntax

Using IOS BGP IP prefix list we are able to provide the most powerful prefix based filtering mechanism. Like route maps, prefix lists are identified by a name (we also can use number but is rather situation). 

ip prefix-list NAME seq nr [ permit | deny ] A.B.C.D / nn  [ ge | le ] value

A.B.C.D -  is your prefix

nn - prefix lenght

ge - greater than or equal

le - less than or equal

X Follow @ipexptobe

Cisco IOS Open Ports: Netstat Alternative for Router Troubleshooting

Quick summary: Cisco IOS does not use the Windows netstat -n command, but show control-plane host open-ports gives a practical view of listening and established TCP/UDP sessions on the router control plane. This is useful for router hardening, troubleshooting management access, and checking whether services such as SSH, Telnet, HTTP, NTP, or BGP are exposed.

X Follow @ipexptobe

Cisco SPAN Port Mirroring: Practical Guide for Troubleshooting

Quick summary: Cisco SPAN port mirroring copies traffic from a source interface or VLAN to a destination interface where you can connect Wireshark, tcpdump, or another packet capture tool. The notes below show a simple local SPAN configuration, direction selection, verification commands, and an HP port monitoring example.

X Follow @ipexptobe

Cisco Configuration Backup to TFTP: Practical IOS Guide

Cisco configuration backup to TFTP is a simple way to keep router or switch configs available for recovery. This updated note preserves the original archive/kron example and adds practical checks for safer operations.

What this backup configuration does

The example below sends the running configuration to a TFTP server every night at 1:00. It also triggers a backup when an engineer saves the configuration with write memory.

X Follow @ipexptobe