topic Connection to Panorama for new deployment failing in Next-Generation Firewall Discussions

Connection to Panorama for new deployment failing

zGomez — Wed, 14 Feb 2024 15:08:30 GMT

Hi,

I have the following issue I am running panorama 10.2.7h3 my new device P440 is also running 10.2.7h3.

When I want to onboard the device into panorama it is not working.

I am onboarding the device with Authenticatio keys.

Following the below procedure.

Add a Firewall as a Managed Device (paloaltonetworks.com)

I have also reset the secure communication on the PA440 and tried removing adding the serials from panorama.

The connection doesn't come up.

In the ms.log file i am getting the following.

Seems to be related to SSL.

2024-02-14 15:49:05.844 +0100 COMM: connection established. sock=24 remote ip=10.255.125.50 port=3978 local port=54018
2024-02-14 15:49:05.844 +0100 cms agent: Pre. send buffer limit=46080. s=24
2024-02-14 15:49:05.844 +0100 cms agent: Post. send buffer limit=425984. s=24
2024-02-14 15:49:05.844 +0100 Error: cs_load_certs_ex(cs_common.c:544): keyfile not exists
2024-02-14 15:49:05.844 +0100 Error: pan_cmsa_tcp_channel_setup(src_panos/cms_agent.c:1340): cms agent: cs_load_certs_ex failed2024-02-14 15:49:05.845 +0100 cmsa: client will use default context
2024-02-14 15:49:05.846 +0100 Error: _get_current_cert(sc3_utils.c:117): sdb node 'cfg.ms.ca' does not exist ret -5
2024-02-14 15:49:05.846 +0100 Error: sc3_ca_exists(sc3_certs.c:229): SC3: Failed to get the current CA name.
2024-02-14 15:49:05.846 +0100 Warning: sc3_init_sc3(sc3_utils.c:360): SC3: Failed to get the Current CC name
2024-02-14 15:49:05.846 +0100 SC3: CA: '', CC/CSR: 'd41d48e6-c7da-4a61-8307-79ce0cc33ff7'
2024-02-14 15:49:05.846 +0100 Error: _get_current_cert(sc3_utils.c:117): sdb node 'cfg.ms.ca' does not exist ret -5
2024-02-14 15:49:05.846 +0100 Warning: sc3_get_current_sc3(sc3_utils.c:184): SC3: failed to get SNI
2024-02-14 15:49:05.846 +0100 Warning: sc3_get_current_sc3(sc3_utils.c:187): SC3: failed to get CCN
2024-02-14 15:49:05.847 +0100 Warning: sc3_init_sctx(sc3_ctx.c:302): SC3: not set, skip cert loading
2024-02-14 15:49:05.847 +0100 SC3A: using SNI (from AK): 4591c212-e525-4d70-92fb-4f5243dff4af
2024-02-14 15:49:05.847 +0100 SC3A: using sc3 ctx with no cert
2024-02-14 15:49:05.901 +0100 Error: pan_cmsa_tcp_channel_setup(src_panos/cms_agent.c:1719): panorama agent: SSL connect error. sock=24 err=5

Am i missing something?

taking a pcap also show that panoram is just resetting the connection.

Any help on this would be appreciated.

Re: Connection to Panorama for new deployment failing

StanleyWilson — Wed, 14 Feb 2024 20:58:34 GMT

I am having this same problem with 10.2.6 on both Panorama and FW 3220. I just spent two days with support and they are escalating.

I even changed my MGMT Interface MTU as recommended by this article even though I am not seeing large packets.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wkjSCAQ&lang=en_US%E2%80%A9

Re: Connection to Panorama for new deployment failing

PavelK — Thu, 15 Feb 2024 04:50:22 GMT

Hello @zGomez

it looks like you might be hitting an issue in this KB: Managed Firewalls showing disconnected from the Panorama even though network connectivity is good. Could you check whether following this KB resolves the issue?

Kind Regards

Pavel

Re: Connection to Panorama for new deployment failing

zGomez — Mon, 19 Feb 2024 07:25:14 GMT

Hi Pavel,

I have followed the above article but this did not solve my problem(first thing i tried actually). It turned out that I needed to allow SSL on the policy as an application, it was no longer recognized as panorama on the first connection.

I really have no idea why this is and what has changed. Since the panorama app id allow implicitly ssl on the first connection. (connection to panorma was passing multiple firewalls )

But is solved my panorama connection by allowing ssl in the policy.

Re: Connection to Panorama for new deployment failing

PavelK — Fri, 08 Mar 2024 22:19:45 GMT

Hello @zGomez

thank you for reply.

I see. You might have been hitting an issue described in this KB: Why is traffic on port 3978 Identified as SSL application instead of Panorama application?.

Kind Regards

Pavel