The integration between Prisma SD-WAN and Prisma Access utilizes standard IKEv2/IPSec protocols for tunnel creation. A core component of this is Dead Peer Detection (DPD), which is used to verify the liveness of the IPSec peer. The branch ION device periodically sends IKEv2 informational messages (keepalives) to the Prisma Access Security Processing Node (SPN). If the SPN fails to respond after a set number of retries, the ION device declares the peer dead and can attempt to re-establish the tunnel. This mechanism ensures tunnel state is maintained even when there is no active user data traversing the link.

A. Requiring a manual ping script on a client PC is an unreliable and unscalable method, contrary to the automated, enterprise-grade design of the Prisma SD-WAN solution.

B. Synthetic Probes are used by Prisma SD-WAN for path performance monitoring (measuring latency, jitter, and loss) to make intelligent path selection decisions, not primarily for IPSec tunnel state maintenance.

D. In a standard branch-to-cloud connection model, the branch ION device is the initiator of the IPSec tunnel to the Prisma Access SPN, not the other way around.

1. Palo Alto Networks - Prisma Access Administrator's Guide: In the section describing remote network connections, the guide specifies the mechanism for tunnel health monitoring. It states, "Prisma Access uses Dead Peer Detection (DPD) to monitor the health of the IPsec tunnel." This confirms DPD is the standard method used. (Reference: Prisma Access Administrator's Guide, section "Set Up Remote Network Connections > Tunnel Monitoring").

2. Palo Alto Networks - Prisma SD-WAN Administrator's Guide: When configuring IPSec tunnels, the guide details the IKE Gateway settings, which include Dead Peer Detection. It describes DPD as the mechanism where the device "periodically sends messages to its peer to verify that the peer is available." The CloudBlade automates the configuration of this standard feature. (Reference: Prisma SD-WAN 9.1 Administrator's Guide, section "IPsec Tunnels > Configure an IKE Gateway", Page 435).