Comprehensive and Detailed Explanation

The transition from "Claimed" to "Online" depends entirely on the ION device's ability to establish a secure, persistent management tunnel to the Prisma SD-WAN Controller.

Connectivity Requirements:The ION device initiates an outbound connection to the controller onTCP Port 443 (HTTPS). It also requires accurate time synchronization to validate SSL certificates, necessitating access toNTP (UDP Port 123).

Scenario Analysis:Since the installer can browse the internet from the LAN, we know the physical link and basic routing/NAT are functional. The issue is specific to themanagement planetraffic.

Root Cause:If an upstream firewall (e.g., a corporate edge firewall or ISP filter) is inspecting SSL traffic or blocking specific FQDNs/Ports required by the ION, the device cannot complete the handshake. Consequently, it remains "Claimed" (registered in the database) but cannot go "Online" (active management session). Options A, C, and D preventprovisioning(configuration push) but generally do not prevent the device from initially checking in and going "Online" if the pipe is open.