Site is Disconnected - Network Playbook

This playbook describes steps to resolve issues when your site is completely disconnected.


Cato constantly monitors the status of your site. In some scenarios, a site can become disconnected when all of your links are down.

The following are different ways to discover that a Site Disconnected issue has occurred:

  • Go to the Stories Workbench page and use the Network XDR preset to find the Site down stories.


    The story presents you with the various events that occurred, an incident timeline, as well as the current site overview, and more.

  • Connectivity events, with the Disconnected sub-type for both the primary and secondary links

Step 1 - Identify the Site Disconnected Root Cause

This section discusses different Cato tools that you can use to identify the root cause of your Site Disconnected issue.

Reviewing the Site's Network Analytics

Use the Network Analytics page for a site to verify the Site Disconnected issue.

  • Analyze the information in the different graphs to identify a possible trend. For example, was there high latency at the time that the Tunnel Age widget shows that the site went down. Alternatively, does the Packet Loss widget show any irregular activity.

  • The Last Mile widget might indicate a trend showing that packets were no longer being sent to your ISP, and this might be an issue with your ISP connection.

  • If, when looking at the graphs, you see that the change was sudden, and not a trend, it could that a cable is disconnected or there was some sudden event external to Cato that caused the problem.

Reviewing Previous Event Data

Look at the events prior to the Connectivity event to see if they indicate a broader issue somewhere in your network. For example, have there been many Reconnect events over the past 24 hours.

Verifying Cato PoP Status

Check the Cato PoP status page to see if there are any issues with the PoP, and if there is a broader regional issue.

Step 2 - Remediating the Site Disconnected Issue

This section provides information about steps you can take to remediate your issues.

Reviewing Recent Configuration Changes

Review changes in the Audit Trail page for the Cato Management Application, and see if there is a configuration that is related to this issue.

Checking Socket Hardware Issues

The remediation steps in this section require physical access to the Socket and ISP hardware.


Note: If you have implemented a high availability configuration, your issue is probably not hardware related as both hardware devices would not fail at the same time.

  1. Perform hardware checks:

    1. Check the Socket front and back panel LEDs. There should be a light on for each WAN port.

    2. Verify that all cables are properly connected. If necessary, unplug and plug the cables in again.

    3. Power cycle the Socket and ISP router/modem.

Reviewing Different Site Data

Look at other sites you might have in the same region, which are connected to the same ISP. See if they are experiencing any issues or if they have a stable connection.

In addition, check your ISP's service status page to see if they are experiencing any issues.


Note: If you are experiencing frequent DIA issues with your ISP (copper/fiber), consider adding an additional link, e.g. cellular or satellite link.

Working with Socket WebUI

Within the Socket WebUI there are several options to understand more about the connectivity issues.

  • Use the Monitoring page to verify the link status. You can hover over the relevant LED to get more information about the connectivity status.

  • Use the Network Tools in the Tools page to run a series of tests.

  • Use the Traffic Capture page to collect a PCAP file and Socket logs for further analysis.

Contacting Support

After performing all the steps above and the issue is still not resolved, please contact Support and provide all necessary information.

Was this article helpful?


Add your comment