topic Re: Cortex XDR - Clients can't reconnect to Tenant after long time offline in Cortex XDR Discussions

Cortex XDR - Clients can't reconnect to Tenant after long time offline

MarioStockinger — Tue, 25 Jan 2022 06:30:09 GMT

We have several Client PCs, Laptops as spare and Client PCs / Laptops on construction sites without internet access that have Cortex XDR installed.

They can only get online in uneven intervals, sometimes several months so they get removed from the tenent.

I have the older client installer packages still active in the tenant even if they are outdated.

When they have internet access they still cant reconnect and update to the newest cortex xdr version.

That's very annoying and time consuming to fix that.

Before cortex we had trend micro office scan - it was no big deal at all , did't matter how long a client was offline , as soon as it was back online it updated without any issues.

I have no idea how we could solve this issue.

Maybe someone can help me and has a suggestions what to do.

Re: Cortex XDR - Clients can't reconnect to Tenant after long time offline

bbarmanroy — Tue, 25 Jan 2022 07:33:07 GMT

Hi @MarioStockinger , you can adjust the Agent settings to ensure the license is not revoked. In your case, the Agent Deletion (days) entry should be a high value within your organization's acceptable standard for a host to remain offline and yet retain the license. Once the license is revoked, the agents won't be able to reconnect to the tenant and automatically update to the supported versions (if the Agent Settings profiles are applied to allow automatic upgrades).

Re: Cortex XDR - Clients can't reconnect to Tenant after long time offline

MarioStockinger — Tue, 25 Jan 2022 07:42:25 GMT

We have set 30/180 days , so the second value is responsible that the client will loose the licence and can't reconnect ?

Did i understand that correctly ?

Is it Possible to pin a licence to a client so it will never loose the licence ?

Re: Cortex XDR - Clients can't reconnect to Tenant after long time offline

bbarmanroy — Tue, 25 Jan 2022 08:15:09 GMT

The 30/180 is default. You're right, you'll need to adjust the '180' (Agent Deletion) to a higher value to ensure the licenses are not revoked. Please take a look at the license revocation process here.

No, it is not possible to pin a license to a host/client as per the current license process. You can use the cytool reconnect command from the endpoint to resume connectivity.

Re: Cortex XDR - Clients can't reconnect to Tenant after long time offline

MarkusKnappe — Tue, 01 Feb 2022 09:51:52 GMT

Have a look at this: https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/reconnect-disconnected-xdr-clients-remotely-an-easy-way/td-p/398365

Re: Cortex XDR - Clients can't reconnect to Tenant after long time offline

Larrry — Wed, 27 Jul 2022 23:56:25 GMT

The PSexec command does not return results and leaves the [Process ID and Agent Version] blank. I asusme that is an environment issue on our end? Either way, this is a good command to run, but how can we locate these clients that have "Lost Connection" or "Agent Deletion" criteria was met? Meaning, How can we find the lost clients using PAN tools? I know that there are Vuln apps or Inventory apps that we can possibly utilize, but this is a manual process and clients can be missed and this is not very easy to perform as a task.