topic Re: All Firewall are disconnected on Data Lake in AIOps for NGFW Discussions

All Firewall are disconnected on Data Lake

staltari — Tue, 11 Oct 2022 08:06:17 GMT

Hi All,

I activeted the AIOps for NGFW on my account.

All firewall seems to be connected to Telemetry, I onboarded all on DataLake but they are still disconnected:

What can I do?

Re: All Firewall are disconnected on Data Lake

svenkatarama — Tue, 11 Oct 2022 13:36:06 GMT

This looks like a screenshot from the CDL App, talking about connectivity for logging. The logging and telemetry, while they both go to the cloud, are actually two different pipelines - one is streaming, and telemetry is actually batch processing.

Can you please check the telemetry pipeline status in your AIOps instance (Settings>Inventory)

Re: All Firewall are disconnected on Data Lake

staltari — Tue, 11 Oct 2022 15:10:19 GMT

Here, is wrote to onboard NGWF on CDL: https://docs.paloaltonetworks.com/aiops/aiops-for-ngfw/get-started-with-aiops/onboard-devices

Anyway, I can't find any Settings menu in the AIOps instance.

Last but not the list, the instance is associating me to a not correct tenant.

As usual, Palo Alto cloud apps are a mess...

Re: All Firewall are disconnected on Data Lake

staltari — Tue, 11 Oct 2022 15:45:31 GMT

What a mess! (as usual)

I found the "telemetry" CDL instance but is in US. No chance to move in europe (obviously I need my data in Europe).

I choose to create the AIOps instance in "Germany" then it can't see US telemetry CDL in US and neither the regular one in the Netherlands. No way to create the AIOps instance in the Netherlands.

I ceated a new AIOps in US, associated to the the "telemetry" CDL in US, but I can't onboard firewalls that are already ondoarder on the regular CDL in the Netherlands.

I tried to open a support case and they send me to ask to the community...

Re: All Firewall are disconnected on Data Lake

svenkatarama — Tue, 11 Oct 2022 17:57:05 GMT

There are a few things to be aware of here / check into here -

In general, the telemetry follows the region that you set up as the logging region. Is that currently Americas?
The Germany instance of AIOps can only work with a Germany-based CDL. All other CDL regions are currently serviced by AIOps running in Americas-based servers. We plan to expand this over time, but currently, this is the limitation.
From the screenshot you posted here, in your AIOps activation, it looks like you did not point it to a CDL tenant (or it did not take that setting). You can do that by clicking the 3 dots beside the icon on the hub, clicking edit, and selecting the CDL tenant.

An overview of the activation process is here - https://live.paloaltonetworks.com/t5/customer-journey-aiops-for-ngfw/onboarding/ta-p/468635?attachment-id=10627

(This is the link in the Live Community pages - LIVEcommunity - Onboarding - LIVEcommunity - 468635 (paloaltonetworks.com)

Re: All Firewall are disconnected on Data Lake

Bath-Spa — Thu, 13 Oct 2022 15:46:06 GMT

Agree this seems like a right mess, no where did I see in the guides on setting this up that Germany only works in Germany so our firewalls Telemetry Region is set to the United Kingdom when I created the AIOps for NGFW I selected Germany as that's in Europe why would I of thought of choosing the US but I'm seeing no data in AIOps even though the firewall seems to be sending it.

But from the comment above I guess it's because our Telementry Region is set to the UK so the AIOps needs to be set to the US for it to work?

I've now setup another instance of AIOPs with the region set to the US (now we have two as we cant seem to delete the one in Germany) but when I try and access the US one I get the error "Error: Entitlements not found for user" but the Germany one loads fine!

Re: All Firewall are disconnected on Data Lake

staltari — Thu, 13 Oct 2022 17:52:41 GMT

My mess is like this:

3 AIOps for NGFW instance: no one is working; I can't remove any.
2 Cortex Data Lake istance:
- one is legacy, where are onboarded all my firewalls; is useless because I've no logging license on firewall; all firewall are Activater and disconnected but I can't remove from there.
- one is "Telemetry only", is in US, but all my firewalls are set to telemetry to Europe because we are in Europe. have I to move to US? Anyway I can't onboard here because are already boarded on the other.

The funniest is that once, the US AIOps shown me the status of 8 of my firewalls. Not all, only 8. I can't understand why...

Re: All Firewall are disconnected on Data Lake

svenkatarama — Thu, 13 Oct 2022 22:39:30 GMT

Can you give this new instance another try? I understand that the system is not fully up in some cases if this error shows up.

Re: All Firewall are disconnected on Data Lake

Bath-Spa — Fri, 14 Oct 2022 08:16:49 GMT

That is working now and i can login to the AIOps in the US Region but there is still no information in there. Do I also need to set my telemetry settings on the firewall to send that to the Americas as well because at the moment that is set to the UK and the current telemetry data lake is in the UK

Re: All Firewall are disconnected on Data Lake

svenkatarama — Fri, 14 Oct 2022 13:38:35 GMT

Please hang on - we are checking to see how the linkages are made on the back end.

Are you still able to see the 8 firewalls in the US instance?

Re: All Firewall are disconnected on Data Lake

svenkatarama — Fri, 14 Oct 2022 13:41:47 GMT

I see the AIOps instance in Americas is not attached to the CDL in UK.

Please click the 3 dots on the right side of the AIOps icon on the hub landing page, click edit, and attach the UK CDL tenant to the AIOps. In a couple of hours or so, the firewall data should show up in the instance, if the data is already flowing into the UK CDL. There should be no need to make any changes to the firewall.

Re: All Firewall are disconnected on Data Lake

staltari — Fri, 14 Oct 2022 15:10:42 GMT

Hi. Now, in the US instance, I can see the same device saw last time: they are 7.

One of those is a demo unit that I already shipped back to Palo Alto months ago.

Can you understand why I can see only these? I have other 9 NGFW configured in the same way.

Re: All Firewall are disconnected on Data Lake

Bath-Spa — Mon, 17 Oct 2022 08:16:11 GMT

That fixed our issues in the end, Thanks for your help Svenkatarama

Re: All Firewall are disconnected on Data Lake

staltari — Mon, 07 Nov 2022 06:52:18 GMT

Just to update, after a month, I'm still in the same mess. No way to fix, no way to have support.

Re: All Firewall are disconnected on Data Lake

sselva — Fri, 23 Dec 2022 00:44:57 GMT

Hi @staltari

please give me one serial which is not being shown in US AIOps

Thanks and Regards,
Sharan Selva

Product Specialist
Palo Alto Networks
https://live.paloaltonetworks.com/t5/aiops-for-ngfw-discussions/bd-p/AIOps_for_NGFW_Discussions

Re: All Firewall are disconnected on Data Lake

staltari — Tue, 27 Dec 2022 15:42:53 GMT

Serial #

007054000219909

Regards

Re: All Firewall are disconnected on Data Lake

sselva — Mon, 09 Jan 2023 18:20:35 GMT

Hi @staltari

!!! Kindly reply to the private message !!!!

Thanks and Regards,
Sharan Selva
Product Specialist
Palo Alto Networks

Re: All Firewall are disconnected on Data Lake

staltari — Tue, 10 Jan 2023 10:25:37 GMT

Hi @sselva, I have not any private message from you.

Regards

Re: All Firewall are disconnected on Data Lake

sselva — Wed, 11 Jan 2023 16:31:08 GMT

Hi @staltari

Kindly Check for the message and reply to it for the further process.

Thanks and Regards,
Sharan Selva
Product Specialist
Palo Alto Networks