Site Reconnected to the PoP - Network Playbook

This playbook describes steps to resolve issues when a site initiates a reconnect to a tunnel.


Cato constantly monitors PoP performance health indicators. When an abnormal condition on a PoP service machine is detected, and it is caused by a specific site, the Cato Cloud may initiate a move to a different PoP service machine.

Step 1- Starting the Site Reconnect to Improve Connectivity Investigation

Reconnected to the PoP issues can be identified through one of the following:

  • Go to the Stories Workbench page and use the Network XDR preset to find the Site reconnected to the PoP to improve connectivity stories.


    The story provides insight about when a reconnect was initiated for a site, what the current status is, and a full timeline of the events.

  • A Connectivity event that includes the following sub-event:

    • Performance issue detected, reconnected to a different service node in the Cato Cloud


Step 2 - Remediation

This section provides information about steps you can take to remedy your issues.

Reviewing Recent Configuration Changes

Review changes in the Audit Trail page for the Cato Management Application, and see if there is a configuration that is related to this issue.

Troubleshoot the Various Issues

  • Check the Network Analytics to see if there was a sudden spike in any of the following metrics:

    • Bandwidth

    • Hosts

    • Flows

  • Check the application analytics to determine if you have a specific host, user, or application, that is causing the increased resource usage

Contact Support

If the issue persists, meaning, you have more than 2 reconnect events with the same event message in the same day, contact Customer Support.

Was this article helpful?

0 out of 0 found this helpful


Add your comment