Comprehensive and Detailed Explanation

Site Templates (often referred to as Site Configuration Templates) are a critical tool for the Zero Touch Provisioning (ZTP) of large-scale deployments in Prisma SD-WAN.

1. Device Pre-staging (Statement C):

One of the primary capabilities of Site Templates is the creation of Device Shells. A device shell is a configuration container that exists in the controller before the physical hardware is installed or connected. By using a template, an administrator can pre-provision the entire configuration (interfaces, routing, subnets) for the " Site " and " Element " (Device). When the physical ION device is later connected to the internet and claimed (associated with the shell via its Serial Number), it immediately inherits this pre-staged configuration, enabling a true " plug-and-play " deployment.

2. Mandatory Variables (Statement B):

To successfully instantiate a functional site from a generic template, specific unique identifiers are required in the variable data set (typically a CSV file).

Site Name: Identifies the location in the portal.

ION Software Version: Ensures the device boots to the specific validated code version required for the deployment, preventing inconsistencies.

ION Serial Number / Device Name: Required to bind the logical configuration (Shell) to the physical hardware. Even if the serial is added later during the claim process, the structure of the template and the deployment workflow mandates these variables to ensure the device can be uniquely identified and managed within the fabric.

Note on Option D: While it is technically possible to re-deploy a template, the Best Practice for " Day 2 " operations (updating or modifying configuration after deployment) is to use Prisma SD-WAN Stacks (Network Stacks, Security Stacks, etc.). Stacks allow for granular, policy-based updates across multiple sites without the destructive or rigid nature of re-applying a full site initialization template. Therefore, D is not the aligned best practice.

Comprehensive and Detailed Explanation

In Prisma SD-WAN (CloudGenix), Path Policies control how application traffic is steered across WAN links. To ensure that traffic is automatically shifted from a saturated circuit to another circuit with available bandwidth, both circuits must be configured as Active Paths within the policy rule.

When multiple paths are designated as " Active, " the ION device treats them as a shared pool of available resources. The system continuously monitors the bandwidth utilization (capacity) and health (latency, jitter, loss) of all active links. If " Circuit A " (500 Mbps) becomes saturated or approaches its defined bandwidth limit, the ION ' s intelligent scheduler will automatically direct new application flows to " Circuit B " (100 Mbps) because it is a valid, healthy Active path with available capacity. This achieves effective load balancing and bandwidth aggregation.

In contrast, configuring " Circuit B " as a Backup Path (Option A or B) creates a strict priority relationship. Traffic would only move to the Backup path if the Active path completely failed or violated its configured SLA (Path Quality Profile) significantly enough to be considered " down. " Mere bandwidth saturation might not trigger an SLA failure immediately, potentially leading to dropped packets on the saturated link while the backup link remains idle. Therefore, placing Both circuits under active path is the correct configuration for dynamic capacity management.

In complex retail or banking environments, maintaining strict network segmentation is a regulatory and security requirement. Prisma SD-WAN utilizes Virtual Routing and Forwarding (VRF) to provide this isolation, ensuring that high-security traffic, such as ATM transactions or teller cash registers, remains logically separated from Guest Wi-Fi or general corporate applications. While isolation is the default state, route leaking is used to allow specific communication between these VRFs—for instance, allowing multiple isolated segments to reach a common shared service like a DNS server or a centralized security gateway.

To verify that these configurations have been correctly pushed from the Controller to the local ION device, administrators utilize the ION CLI (Command Line Interface) for deep-dive diagnostics. The command inspect vrf route_leak_rule all is the definitive tool for this purpose. Unlike " show " commands which typically provide interface status, " inspect " commands in the Prisma SD-WAN ecosystem are designed to pull real-time operational state data from the control plane ' s internal databases.

When executed, this command displays the specific prefix-level rules that allow routes to " leak " from one VRF table into another. It provides visibility into the source VRF, the destination VRF, and the exact network prefixes or default routes being shared. This is critical for troubleshooting " Day 2 " operations; if a teller register cannot reach a shared database, the administrator can use this command to confirm if the necessary route leak rule is active and accurately reflecting the intent of the VRF Profile configured in the portal. Without this command, verifying inter-VRF reachability would be limited to trial-and-error connectivity tests, making it an essential part of the Prisma SD-WAN engineer ' s toolkit.

Comprehensive and Detailed Explanation

Prisma SD-WAN utilizes Link Quality Monitoring (LQM) to maintain a real-time health score for every WAN path.

To ensure the system knows the quality of a path before sending critical user traffic onto it, the ION device uses Active Probing.

Mechanism: The ION sends synthetic probe packets (typically UDP) across the Secure Fabric (VPN tunnels) and Direct Internet paths to its peers. These probes measure Latency, Jitter, and Packet Loss .

Active vs. Passive: While the system does use Passive Monitoring (observing actual user flows) when traffic is present to reduce overhead, Active Probes are essential for idle links or backup paths. Without active probing, the ION would have no data to make an intelligent steering decision for the first packet of a new video call. This ensures that " Real-Time " policies always have up-to-date metrics to select the best path immediately.

Comprehensive and Detailed Explanation

Prisma SD-WAN separates real-time visibility from historical summarization.

Reports (C): The Reports section is the dedicated engine for generating historical summaries. Administrators can create custom report templates (e.g., " Monthly Executive Summary " ) that include specific widgets like " Top Applications by Volume, " " Site Availability, " or " Circuit Utilization. " Crucially, this feature allows for Scheduling , where the system automatically generates the PDF report at a set interval (e.g., first day of the month) and emails it to a distribution list.

Activity Charts (A) / Media Analytics (B): These provide interactive, visual graphs for ad-hoc analysis but are not designed for generating downloadable, scheduled PDF summaries for management.

Flow Browser (D): This is for deep-dive troubleshooting of individual sessions, not for high-level aggregate reporting.