Skip to main content

Troubleshooting

This page collects Predict problems that need diagnosis, keyed by symptom. Each entry describes what the model is doing, then what to try. For frequently asked questions about Predict's scope and behavior, see the Predict FAQ. For the scope of a prediction, see Prediction Scope; for the tables behind these answers, see Reference.

I don't see Predict, or I can't edit a change set​

Several independent conditions must all hold. If any one is unmet, Forward Predict does not appear.

  • Predict is enabled for your organization. This is off by default and turned on per organization. A fully licensed org still won't show Predict until it's enabled.
  • Your role on this network can modify change sets. Viewing and editing a change set use the same permission, so a read-only role sees no Predict application at all, not a disabled one. You need an operator-level role (or higher) on the specific network.
  • Your license tier includes Predict.

An expired Predict license drops Predict to read-only: existing predicted snapshots stay viewable, but creating or committing a change set is blocked until the license is renewed.

What to try:

  • Confirm with your Forward account team that Predict is enabled for your organization.
  • Ask your Forward or organization administrator to confirm your role on the network is operator-level or higher.
  • Check your tier under Settings > System > License. The Predict entitlement shows as Forward Predict.

The previewed config isn't what my commands should produce​

After entering CLI commands and previewing the config diff, the predicted running config does not match what those commands would produce on the device. Command merge is vendor-aware, and it covers eight OS families: Cisco IOS-XE, IOS, NX-OS, IOS-XR, and ASA; Arista EOS; and Juniper Junos and SRX. A command or construct outside that coverage can merge incorrectly.

What to try:

  • Switch the device editor's Modify using: radio to Config file and paste the full running config instead. This replaces the device's baseline directly and skips command merge.
  • Report the case so Forward can correct the command-merge logic for that vendor or command.

See Command Merge by Vendor.

My change had no effect on a remote device, or a route didn't propagate​

A change on one device produces no change on a device elsewhere in the network. Two causes are common.

  • The protocol carrying the route is not propagated. In 26.9, Forward Predict re-propagates BGP, including routes redistributed into BGP. OSPF, static and connected routes, the SD-WAN overlay (OMP), IS-IS, EIGRP, and RIP are not re-propagated in this release. If a change's effect must travel through one of those protocols to reach the device in scope, the prediction stops at the boundary.
  • The route is learned from outside the snapshot. Forward Predict can modify a route learned from an external peer only if that prefix's inbound advertisement was collected. If it wasn't, it leaves the route unchanged, so modifying an inbound route-map to filter that prefix shows no impact.
OSPF re-propagation is not in 26.9

Forward Predict does not re-propagate OSPF in 26.9, so a change that must travel through OSPF to reach the device in scope does not propagate. A route already redistributed from OSPF into BGP still appears in Prefix Search, within the BGP domain; a prefix that never enters BGP is not shown.

What to try:

  • Confirm which protocol carries the traffic in scope. See Supported Routing Protocols.
  • Confirm every device the route must pass through runs a supported platform. An unsupported transit device stops re-propagation at that point. The diagram under Supported Platforms shows how Forward Predict handles an unsupported device along the chain.
  • For an externally learned route, inject the advertisement as part of the change so Forward Predict has the route to work with. See How Predict Works → Accuracy Boundaries.

A route-table diff shows no change on some devices​

A base-vs-predicted routing-table diff shows differences on some devices and none on others, even where the change was expected to reach both. Forward Predict re-synthesizes a full routing table only on the supported platforms. A device on any other platform participates in the model but shows no routing-table differences in the diff.

Keep the device on the platform list in Routing-State Synthesis Platforms to see a routing change reflected on it.

A predicted best path differs from the real device​

For a prefix reachable by several equally good paths, the predicted best path may not match the single path a device installed, or Path Analysis may show more viable next hops than you expect. Two behaviors cause this.

  • Equal-cost paths. Forward Predict installs every equal-cost path, up to the device's maximum-paths limit, and treats them all as viable next hops. It does not model the per-flow hash that sends a given flow out one member, so a flow can appear to take any of the equal-cost paths.
  • Remaining ties. When paths are still equal after every criterion Forward Predict models, a real device breaks the tie by something it does not reproduce, such as which route it received first. Forward Predict reports one valid path; the device may have installed a different one.

What to try:

  • Use Path Analysis on the predicted snapshot to see all viable next hops rather than a single installed route, and treat each equal-cost member as reachable.
  • Check the device's maximum-paths (multipath) configuration if the number of installed paths is not what you expect.
  • When a result turns on the single best path among tied routes, treat the reported path as one valid outcome, not a guaranteed match to the device.

See How Predict Works → Accuracy Boundaries.

My prediction doesn't match the live network​

A prediction models the network as captured in the base snapshot. If the live network changed after that snapshot was collected (a config edit, a failover, or a new route from an external peer), the base no longer matches production and the prediction can be inaccurate.

What to try:

  • Collect a fresh snapshot and re-run the prediction against it.
  • Check when the base snapshot was collected, and whether the live network has changed since.

See Accuracy and Limitations.

I can't edit firewall rules​

Three conditions gate firewall rule editing:

  • License. Firewall Predict requires the correct license tier.
  • Platform. It supports Palo Alto (PAN-OS) firewalls only. The rule editor does not appear for other vendors; use a config-based change on those devices instead.
  • Rulebase. Panorama pre- and post-rulebases are read-only. Their rows appear for context with actions disabled; only the device's local rulebase is editable.

See Firewall Predict.

I can't remove a firewall rule I added with the row's Restore​

The per-row Restore action is hidden on an added rule: it reverts a rule to its committed state in the base snapshot, and an added rule has no committed state to return to. The toolbar Restore button does drop an added rule.

The Modify firewall rules table: the Changes column shows added, modified, and deleted badges; a modified rule shows its baseline value struck through above the new value; and a negated source address shows a minus-in-a-circle icon beside the value

What to try:

  • Select the added rule (and any others) with the row checkboxes, then click the toolbar Restore button to drop the additions.
  • Use Delete to remove a committed rule instead; a deleted rule keeps a per-row Restore icon to bring it back.

The firewall editor shows an empty rulebase​

When Firewall Predict can't parse a device's PAN-OS config, the editor falls back to an empty rulebase and shows no rules to edit.

What to try:

  • Confirm the device parsed cleanly in the base snapshot. A parsing failure on the device blocks the firewall rule editor for it.
  • Contact Forward Support if the config should parse but the rulebase is empty.