topic Re: Service Connection Error on Primary Panorama Configuration not in Sync in Prisma Access Discussions

Service Connection Error on Primary Panorama Configuration not in Sync

chrissmithgt — Wed, 21 Aug 2019 14:16:53 GMT

I am getting this error on the service connection and do not see away to sync the configuration. I have tried to commit also commit and push there is nothing to commit. How do you sync the configuration with the cloud service? I have failed over to the HA and nothing changes. Suggestions.

Chris Smith

Re: Service Connection Error on Primary Panorama Configuration not in Sync

Sai_Tumuluri — Wed, 21 Aug 2019 16:53:26 GMT

@chrissmithgt

You can check commit error reason using the following document and let me the error reason

https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/Verify-Commit-Failure-Reason-on-Prisma-Access-Firewall/ta-p/283222

more references

https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/Prisma-Access-Useful-Resources/ta-p/282482

Re: Service Connection Error on Primary Panorama Configuration not in Sync

chrissmithgt — Wed, 21 Aug 2019 17:01:15 GMT

Looks like we might be hitting a bug. These are my primary and secondary panoramas and I am not seeing the prisma information any more. I have run the panorama debug url and cleared preferences and nothing is changing.

Re: Service Connection Error on Primary Panorama Configuration not in Sync

Sai_Tumuluri — Wed, 21 Aug 2019 17:03:59 GMT

@chrissmithgt Try logging out and logging in

if it does not fix it, try the steps in the following link to reauthenticate Panorama to Prisma Access

https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/Panorama-Connectivity-Issues-to-Prisma-OTP-errors/ta-p/282891

Re: Service Connection Error on Primary Panorama Configuration not in Sync

chrissmithgt — Wed, 21 Aug 2019 19:02:04 GMT

Still showing out of sync.

Shows vaildation error but no information to check

Re: Service Connection Error on Primary Panorama Configuration not in Sync

Sai_Tumuluri — Wed, 21 Aug 2019 19:44:07 GMT

Click on "Validation errors" to see commit error

You can check commit error reason using the following document and let me the error reason

https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/Verify-Commit-Failure-Reason-on-Prisma-A...

more references

https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/Prisma-Access-Useful-Resources/ta-p/2824...

Re: Service Connection Error on Primary Panorama Configuration not in Sync

Sai_Tumuluri — Thu, 22 Aug 2019 13:52:32 GMT

is the issue solved?

Re: Service Connection Error on Primary Panorama Configuration not in Sync

chrissmithgt — Thu, 22 Aug 2019 14:16:05 GMT

This issue has not been resolved. It still indicates out of sync with no evident way to sync the connection. Shows a vaildation error but no hyper link to give an explination.

Re: Service Connection Error on Primary Panorama Configuration not in Sync

Sai_Tumuluri — Thu, 22 Aug 2019 15:23:07 GMT

@chrissmithgt

In general clicking, the "Validation error" should show the error. One of the common reason is ike gateway config. If the following link does not help, I would recommend a TAC Case

https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/IKE-Gateway-Commit-Failure-Peer-Gateway-ID-Must-Be-Defined/ta-p/283024

Re: Service Connection Error on Primary Panorama Configuration not in Sync

chrissmithgt — Thu, 22 Aug 2019 15:11:39 GMT

I have a TAC case open.

Re: Service Connection Error on Primary Panorama Configuration not in Sync

Sai_Tumuluri — Mon, 26 Aug 2019 16:22:42 GMT

@chrissmithgt did we get the root cause from tac case?

Re: Service Connection Error on Primary Panorama Configuration not in Sync

Sai_Tumuluri — Mon, 26 Aug 2019 17:06:47 GMT

was rca identified ?

Re: Service Connection Error on Primary Panorama Configuration not in Sync

chrissmithgt — Mon, 26 Aug 2019 18:32:57 GMT

No TAC is still looking into the situation. It is still out of sync with no way to sync. There is no hyper link to click on to indicate what is not working. Hopefully, TAC can sync back up with me to finish troubleshooting this issue. The engineer had to jump off my call on Friday. He had a hard stop at 3pm. So I am waitining on him or someone else to contact me to try somemore troubleshootng efforts.

Re: Service Connection Error on Primary Panorama Configuration not in Sync

UmarKhan — Tue, 16 Aug 2022 02:26:24 GMT

Was this resolved? IF SO WHAT WAS THE FIX?

Re: Service Connection Error on Primary Panorama Configuration not in Sync

OscarAlvarez — Wed, 12 Oct 2022 18:57:16 GMT

Hi There,

For future references, here is the information for the issue in question.

Symptom

Panorama > Cloud services > Status shows the service connection config status as error and in red color.

The message on the error is displayed as "Configuration is not in sync" and a Job ID.

There is no impact observed on the service connection functionality.

Cause

This error message indicates that the configuration in the service connection template or shared configuration has been changed.

A panorama local commit has been done afterwards.

A push was done to other components like Mobile users or remote networks but not to the service connection.

This does not necessarily indicate a problem but the denotes that some part of configuration was changed and a push has not been done to the service connection, hence config mismatch.

The existing configuration sent to the service connection infrastructure continues to work as it is.

This can further be validated by hovering the mouse over the Config status for other services like Mobile users.

The Job ID will be different for the ones showing OK compared to the service connection status which will show older Job ID.

Resolution.

Perform a minor or dummy change in the shared configuration like an object change.
Perform a local panorama commit & Push to the Prisma Access and select service setup as well in the Prisma Access tab.
This selection is to be under Push window > Edit selection > Push Scope selection > Prisms Access.
Once a commit is sent to the Prisma Access (including service setup), the status will first change to "Commit in Progress" and then "OK" if the commit is successful.

Additional Information

This is expected behaviour and not an error or problem.
Even if the change is in Shared config which does not apply to the service connection, Commit & Push should be done to all the nodes to avoid this status change.
Alternatively, ignore the config status error since this would be expected when changes are made in shared config and push is not done to the service connection.

Regards,

Oscar Alvarez | Palo Alto Networks Technical Support