Prisma Access Traffic Steering fails to work when TCP handshake is not completed.

• Prisma Access Traffic Steering is configured which uses Policy-Based Forwarding (PBF).
• PBF relies on the URL details so URL identification is a must.
• When URL's reachability check fails, the traffic Steering fails to work.

• Prisma Access
• Traffic Steering

• The successful connection initiation allows the device to inspect the Server Name Indication (SNI) field within the client's TLS/SSL "Client Hello" message.
• The SNI contains the hostname (URL) the client is trying to reach, which is the actual criterion used for PBF steering.
• The PBF rule fails when its  (the URL/SNI) cannot be validated unless the required TCP handshake is first established trough internet. 

1. Allow traffic from the Prisma Access cloud IP address on the destination Server instead of Traffic Steering.
2. Use destination based on FQDN instead when there is no dynamic IP resolution.
3. Use destination based on IPs when possible.

Traffic Steering Requirements