topic Re: Redistribution Agent UserID(vsys1): details: close connection to agent in General Topics

Redistribution Agent UserID(vsys1): details: close connection to agent

Reynold — Sun, 31 Jul 2022 06:33:47 GMT

I recieved this system alert every 10mins.

Redistribution Agent UserID(vsys1): details: close connection to agent

Please help.

Thanks.

Rey

Re: Redistribution Agent UserID(vsys1): details: close connection to agent

rxie — Mon, 01 Aug 2022 03:05:34 GMT

suggestions:

1. >tail follow yes mp-log distributord.log --- to look for error logs

2. if needed, turn on debug or dump level logs

admin@PA-VM-Site-B(active)> debug distributord on XXX
debug debug
dump dump
error error
info info
warn warn

3. check out https://live.paloaltonetworks.com/t5/customer-advisories/intermediate-certificate-authority-expiry-impacting-user-id/ta-p/454763

Re: Redistribution Agent UserID(vsys1): details: close connection to agent

Reynold — Mon, 01 Aug 2022 08:09:28 GMT

I got these error logs from tech support.

2022-08-01 11:00:55.141 +0800 Error: pan_user_id_agent_open_conn_i(pan_user_id_uia.c:2563): pan_user_id_ssl_conn_open(P xxx.xx.x.xx) failed: Error: Failed to connect to IP xxx.xx.x.x(IP xxx.xx.x.xx):5009
2022-08-01 11:00:55.141 +0800 Error: pan_user_id_agent_uia_show_config(pan_user_id_uia.c:2185): pan_user_id_agent_open_conn(IP xxx.xx.x.xx) failed: Error: Failed to connect to IP xxx.xx.x.xx(IP xxx.xx.x.xx):5009

any ideas how I could fix this? Thanks.

Re: Redistribution Agent UserID(vsys1): details: close connection to agent

rxie — Mon, 01 Aug 2022 08:23:35 GMT

-looks like transmit layer level reachability issue.

-make sure the firewall can reach the destination ip:5009 from the specified source of user-id service.

-take a tcpdump on the management port, then view the pcap:

> tcpdump filter "host X.X.X.X and port 5009"

> view-pcap mgmt-pcap mgmt.pcap

-might as well open a case to PA TAC

Re: Redistribution Agent UserID(vsys1): details: close connection to agent

Reynold — Mon, 01 Aug 2022 08:28:53 GMT

alright. I will check the source destination ip:5009

Thanks. will update soon.