article AIOps for NGFW FAQ in AIOps for NGFW Articles

AIOps for NGFW FAQ

jhsiao — Tue, 11 Apr 2023 03:49:14 GMT

From licensing to telemetry and data privacy, here are the frequently asked questions for Palo Alto Networks AIOps for NGFW.

Re: AIOps for NGFW FAQ

Ramkishan — Wed, 31 Aug 2022 12:03:57 GMT

are you also collecting firewall configuration ?

Re: AIOps for NGFW FAQ

priyer — Wed, 31 Aug 2022 18:59:28 GMT

Hi @Ramkishan

Yes, we do collect the firewall configuration in the telemetry bundles to process and provide various types of alerts and forecasts in AIOps.

Kindly refer to the below documents for more information:
https://docs.paloaltonetworks.com/pan-os/u-v/pan-os-device-telemetry-metrics-reference
https://docs.paloaltonetworks.com/aiops/aiops-for-ngfw/get-started-with-aiops/about-metrics
https://docs.paloaltonetworks.com/aiops/aiops-for-ngfw/summary/summary-overview#idf0f966f9-2629-4cs98-95e7-fb0c80611be1

Regards
Prasanna Iyer
Product Specialist
Palo Alto Networks
https://live.paloaltonetworks.com/t5/aiops-for-ngfw-discussions/bd-p/AIOps_for_NGFW_Discussions
*Don’t forget to accept the solution provided!*

Re: AIOps for NGFW FAQ

TAISMPaloAlto — Mon, 24 Oct 2022 09:40:13 GMT

Hi,

We have PAN-OS 10.2.3 and telemetry enabled . However "Send File to CDL Receiver Failed" messages are coming. Device certificate installed and " Current Device Certificate Status Valid" .Any suggestion

Re: AIOps for NGFW FAQ

ravsingh — Mon, 24 Oct 2022 11:44:12 GMT

Hi @TASIMPaloAlto,

To help you further with this issue, please provide me with the following details:

> Is it working before or have you freshly onboarded your device?

> Have you changed any configuration?

> Are you using service route in your firewall?

Regards,
Ravi Kumar Singh
Product Specialist
Palo Alto Networks
http://live.paloaltonetworks.com/t5/cloud-ngfw-help-center/ct-p/Cloud_NGFW
*Don’t forget to accept the solution provided!*

Re: AIOps for NGFW FAQ

TAISMPaloAlto — Mon, 24 Oct 2022 12:15:01 GMT

> Is it working before or have you freshly onboarded your device? >>> Fresh

> Have you changed any configuration? New config

> Are you using a service route in your firewall? No

Re: AIOps for NGFW FAQ

Sec101 — Mon, 19 Dec 2022 20:56:12 GMT

If you have panorama managing all of your firewalls, can you just configure panorama to send this data instead of configuring every firewalls certificates? Or is there something beneficial to having each device registered?

Re: AIOps for NGFW FAQ

sselva — Fri, 23 Dec 2022 00:40:45 GMT

Hello @Sec101

Panorama does not provide the health telemetry that comes direct from each firewall. Each device makes direct connection to cdl for telemetry and logs. There is no alternative to use panorama to proxy those connections.
This is the way-->_<

Thanks and Regards,
Sharan Selva

Product Specialist
Palo Alto Networks
https://live.paloaltonetworks.com/t5/aiops-for-ngfw-discussions/bd-p/AIOps_for_NGFW_Discussions

Re: AIOps for NGFW FAQ

sselva — Tue, 27 Dec 2022 16:15:26 GMT

Hello @Sec101

Hope you are doing well,

This only serves as a follow-up to the query.
Do you still need help, or can we just close the query now?

Thanks and Regards,
Sharan Selva
Product Specialist
Palo Alto Networks

Re: AIOps for NGFW FAQ

Sec101 — Wed, 28 Dec 2022 15:12:33 GMT

we are good. You should build in a feature where panorama feeds aiops for everything. Just like log forwarding on security rules. That way you don't have to configure every firewall- you just configure panorama.

Re: AIOps for NGFW FAQ

LCMember17013 — Tue, 14 Feb 2023 19:56:54 GMT

I am having the same issue Failed to send: file 'PA_xxx_dt_10.2.2-h2_20230214_1130_1-hr-interval_HOUR.tgz'

Has anyone found a solution to this problem? Some firewalls are working and onboarded, but most are not.

info for one of the firewalls:

show device-telemetry settings

Device Telemetry Settings:
device-health-performance: yes
product-usage: yes
threat-prevention: yes
region: americas
status: Device Certificate is valid

(active)> show device-telemetry settings stats details

Device telemetry details:
Send interval : 60 minutes
Timestamp for send : 07:18:28
End point : br-prd1.us.cdl.paloaltonetworks.com

(active)> show device-telemetry stats all

Device Telemetry Statistics:
device-health-performance:
last-attempt: Mon Feb 13 17:38:03 EST 2023
last-success: Wed Feb 8 04:18:04 EST 2023
num-of-failed-attempts: 531
reason: CDL Receiver Key Empty
status: failed
product-usage:
last-attempt: Mon Feb 13 17:38:03 EST 2023
last-success: Wed Feb 8 04:18:04 EST 2023
num-of-failed-attempts: 531
reason: CDL Receiver Key Empty
status: failed
threat-prevention:
last-attempt: Mon Feb 13 17:38:03 EST 2023
last-success: Wed Feb 8 04:18:04 EST 2023
num-of-failed-attempts: 531
reason: CDL Receiver Key Empty
status: failed

(active)> tail follow yes mp-log device_telemetry_send.log
2023-02-13 17:38:03,098 dt_send INFO sorted file list: tmp_dir: /opt/panlogs/tmp/device_telemetry/hour/*
2023-02-13 17:38:03,098 dt_send INFO TX_DIR: send file dir: fname: /opt/panlogs/tmp/device_telemetry/hour/PA_sn_dt_10.2.2-h2_20230213_1730_1-hr-interval_HOUR.tgz
2023-02-13 17:38:03,098 dt_send INFO TX FILE: send_fname: /opt/panlogs/tmp/device_telemetry/hour/PA_sn_dt_10.2.2-h2_20230213_1730_1-hr-interval_HOUR.tgz
2023-02-13 17:38:03,098 dt_send INFO TX_FILE: dest server ip: 35.184.126.116
2023-02-13 17:38:03,099 dt_send INFO TX FILE: send_file_cmd: /usr/local/bin/dt_curl -i 35.184.126.116 -f /opt/panlogs/tmp/device_telemetry/hour/PA_sn_dt_10.2.2-h2_20230213_1730_1-hr-interval_HOUR.tgz
2023-02-13 17:38:03,502 dt_send INFO TX FILE: curl cmd status: 9, 9; err msg: 'CDL Receiver Key Empty'
2023-02-13 17:38:03,505 dt_send INFO update send failed count: resend_count: 530, update_count = 531
2023-02-13 17:38:03,507 dt_send INFO update_tx_failed_count: failed send: set intvl resend-failed-count to 3
2023-02-13 17:38:03,518 dt_send ERROR TX FILE: Failed to send file /opt/panlogs/tmp/device_telemetry/hour/PA_sn_dt_10.2.2-h2_20230213_1730_1-hr-interval_HOUR.tgz for intvl=. resend_count: 530, update_count: 531, cmd status: 9
2023-02-13 17:38:03,518 dt_send ERROR TX_DIR: send file dir: Failed to send file /opt/panlogs/tmp/device_telemetry/hour/PA_sn_dt_10.2.2-h2_20230213_1730_1-hr-interval_HOUR.tgz.

Re: AIOps for NGFW FAQ

bschaper — Tue, 14 Feb 2023 20:04:23 GMT

I am actually working on the same problem with 11 Pa-440s. My research as led to a few possible things, that may help.

1. MTU size on the management interface, although this seemed more related to the retrieving of certificates.

2. Firewall policies preventing backend connections

3. Running "request certificate fetch" to retrieve the certificate.

I have 30 firewalls, and only a portion seem impacted. All running 10.2.3. I rebooted them overnight, but that only fixed it for a bit. I thought refetching the cert would help, and to my surprise that one suddenly worked. So I am doing that now.

I feel like this is more of a backend issue with PA then a true firewall configuration issue now. If this doesn't help, I plan to open a TAC case.

Re: AIOps for NGFW FAQ

bschaper — Tue, 14 Feb 2023 20:10:42 GMT

I will throw this out as well, in the off chance AIOps sees it. All the firewalls I just ran "request certificate fetch" on also tried to fetch the certificate automatically around 4:52am and that is the same time they all stopped reporting as well.

But these fetches were successful.

Re: AIOps for NGFW FAQ

Sec101 — Fri, 03 Mar 2023 14:29:23 GMT

Seeing the sam ething

Re: AIOps for NGFW FAQ

MMadrala — Tue, 04 Jul 2023 15:01:11 GMT

Any idea what the average size of telemetry package is?

We have a remote site with small link and don't want telemetry to utilize all of it.

Re: AIOps for NGFW FAQ

Khairul.Nizam — Thu, 23 Jan 2025 15:00:28 GMT

I have firewalls and Panorama. This is the 1st time I heard about AIOps. How can I utilize this in my environment?