You can use mist testing tools

OR

To test from pcli, gather details below and perform a traceroute/service-ping 

service-ping syntax:

service-ping [count <count>] [size <size>] [timeout <timeout>] [set-df-bit] [service-name <service-name>] [tenant <tenant>] [source-ip <source-ip>] router <router> node <node> <destination-ip>

Traceroute syntax:

traceroute [max-hops <max-hops>] [wait-time <wait-time>] [egress-interface <egress-interface>] [source-ip <source-ip>] [gateway-ip <gateway-ip>] [service <service>] [tenant <tenant>] [peer <peer>] router <router> node <node> <destination-ip>

Find the service name, tenant name, and network-interface name using the commands below from pcli.

From the perspective of the mist, Service is the Applications

and Tenants are Network

# show tenant members

# show network-interface

# show service

Now perform the tests below to see if traffic is allowed. 

[email protected]# traceroute egress-interface wan2 source-ip 10.10.10.10 service Internet-WAN2 tenant lan1 8.8.8.8

traceroute to 8.8.8.8, 64 hops max

0 10.2.2.2 3 ms 10.2.2.2 0 ms 10.2.2.2 0 ms

1 192.168.2.1 1 ms 192.168.2.1 0 ms 192.168.2.1 0 ms

2 103.182.68.33 2 ms 103.182.68.33 3 ms 103.182.68.33 1 ms

3 103.78.159.1 1 ms 103.78.159.1 1 ms 103.78.159.1 3 ms

4 103.169.57.201 21 ms 103.169.57.201 22 ms 103.169.57.201 22 ms

5 * * *

6 8.8.8.8 19 ms 8.8.8.8 19 ms 8.8.8.8 19 ms

✔ Running traceroute...

[email protected]# service-ping service-name Internet-WAN2 tenant lan1 source-ip 10.10.10.10 8.8.8.8

PING 8.8.8.8 56 bytes of data.

Ping from 8.8.8.8 (8.8.8.8): icmp_seq=0 ttl=60 time=24.732ms

Ping from 8.8.8.8 (8.8.8.8): icmp_seq=1 ttl=60 time=18.221ms

Ping from 8.8.8.8 (8.8.8.8): icmp_seq=2 ttl=60 time=19.776ms

Ping from 8.8.8.8 (8.8.8.8): icmp_seq=3 ttl=60 time=19.712ms

--- 8.8.8.8 ping statistics ---