topic Re: Some Palo Alto firewalls in our network can't register to Cortex Data Lake. in Prisma Access Discussions

Some Palo Alto firewalls in our network can't register to Cortex Data Lake.

IhnatenkoD — Thu, 05 Aug 2021 14:48:59 GMT

Hello!

We have about 10 offices, each of them has a firewall, all of them are under Panorama control. Some of these firewalls cannot register in the Cortex Data Lake, if I try to add them manually there, I see the Certificate Status "Needs certificate".

Licenses aren't expired. I tried steps from that doc:

https://live.paloaltonetworks.com/t5/prisma-access-articles/firewall-unable-to-register-to-cortex-data-lake/ta-p/282908

and this:

https://live.paloaltonetworks.com/t5/general-topics/connecting-fw-on-pan-os-9-0-1-to-cortex-data-lake-logging/m-p/280746#M75875

nothing helps.

Re: Some Palo Alto firewalls in our network can't register to Cortex Data Lake.

securehops — Thu, 05 Aug 2021 17:26:10 GMT

Are the firewalls all part of the same CSP account?

Re: Some Palo Alto firewalls in our network can't register to Cortex Data Lake.

IhnatenkoD — Fri, 06 Aug 2021 04:53:09 GMT

I think yes. All firewalls belong to one organization, all of them I can see in one place on Palo Alto portal and all of them are managed from one Panorama.

Re: Some Palo Alto firewalls in our network can't register to Cortex Data Lake.

IhnatenkoD — Fri, 06 Aug 2021 04:59:51 GMT

From this solution:

https://live.paloaltonetworks.com/t5/prisma-access-articles/firewall-unable-to-register-to-cortex-data-lake/ta-p/282908

When I added command: request logging-service-forwarding certificate fetch

after maybe 30 sec I checked the job (show jobs all) and this job was failed:

Re: Some Palo Alto firewalls in our network can't register to Cortex Data Lake.

securehops — Fri, 06 Aug 2021 14:49:34 GMT

Based on your previous comments, you tried some good troubleshooting.

From Panorama, go to Panorama tab, device deployment, licensing , click refresh. select one of the bad firewalls and click refresh

You can also try to restart the management server using command

debug software restart process management-server

What version of pan-os?

Re: Some Palo Alto firewalls in our network can't register to Cortex Data Lake.

IhnatenkoD — Mon, 09 Aug 2021 05:59:53 GMT

I have a 10.0.6 version of PAN-OS on Panorama and on one of the bad firewalls (on another bad firewalls I have 9.1.3h ver.). And I have refreshed licenses from Panorama as you advised, unfortunatelly it didn't help.

About restarting the management server: you talk about Panorama or firewall?

Re: Some Palo Alto firewalls in our network can't register to Cortex Data Lake.

IhnatenkoD — Wed, 11 Aug 2021 08:54:57 GMT

I repeated all steps and use command "debug software restart process management-server" in the end and it didn't help.

Re: Some Palo Alto firewalls in our network can't register to Cortex Data Lake.

securehops — Wed, 11 Aug 2021 19:22:56 GMT

I would suggest opening a ticket with Cortex team, they will be able to help