Which component of the Prisma SD-WAN solution is responsible for the deep application identification (App-ID) and the generation of flow metrics…

The ION Device is the branch appliance responsible for processing traffic. Its data plane performs deep packet inspection (DPI) using Palo Alto Networks' Layer-7 App-ID engine to identify applications. As it processes these application flows, the data plane also calculates granular performance metrics, including Network Transfer Time and Server Response Time. This information is then sent to the Prisma SD-WAN Controller for centralized visibility and analytics. The core function of traffic inspection and metric generation happens locally on the ION device at the branch.

A. The CloudBlade container: CloudBlades are a platform for API-based integration of third-party services, not for core data plane traffic inspection at the branch.

B. The Prisma SD-WAN Controller: The Controller is the management and control plane. It receives and displays metrics from the ION devices but does not perform the actual packet inspection itself.

D. The API Gateway: The API Gateway facilitates programmatic access and automation for the Prisma SD-WAN fabric; it is not involved in processing live data plane traffic.

---

1. Palo Alto Networks Prisma SD-WAN Administrator's Guide: In the section "Monitor Application Performance," the documentation states, "Prisma SD-WAN ION devices perform deep packet inspection (DPI) to identify and classify applications... The ION device measures network and application performance metrics for each application flow..." This confirms the ION device's role in both App-ID and metric generation. (Reference: Prisma SD-WAN Administrator's Guide, Chapter: Monitor, Section: Monitor Application Performance).

2. Palo Alto Networks Prisma SD-WAN Design and Planning Guide: The architecture overview describes the ION device's function: "The data plane is responsible for packet processing, which includes routing, QoS, path selection, and security functions like application identification." This explicitly assigns App-ID to the data plane of the branch device. (Reference: Prisma SD-WAN Design and Planning Guide, Chapter: Prisma SD-WAN Architecture, Section: ION Devices).

3. Palo Alto Networks Prisma SD-WAN Datasheet: The datasheet highlights the capabilities of the ION devices, stating they provide "Layer 7 application visibility and control" and "application performance score (AQS) based on session-level metrics for jitter, latency, and packet loss." These functions are inherent to the device's data plane. (Reference: Prisma SD-WAN Datasheet, Section: Key Features).