topic Re: No "Apps Seen" / Policy Optimizer data on Panorama in General Topics

No "Apps Seen" / Policy Optimizer data on Panorama

SARowe_NZ — Thu, 15 Dec 2022 00:48:38 GMT

Hi,

We have a new deployment of Panorama using Datalake storage.

Log data from the firewalls is successfully coming through to Panorama, however, there is no "Apps Seen" or info shown for apps under Policy Optimizer.

Rule Usage data is available, and the app data is shown correctly on the local firewalls.

Setup > Management > Policy Rulebase Settings > Policy Application Usage is ticked on the firewalls and on Panorama.

Any ideas before I log it with TAC?

Thanks,

Shannon

Re: No "Apps Seen" / Policy Optimizer data on Panorama

reaper — Tue, 20 Dec 2022 14:01:25 GMT

Did you check if all ports between the firewalls and panorama are open in the right direction? https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/firewall-administration/reference-port-number-usage/ports-used-for-panorama

You may try to restart panorama to see if that 'jiggles' anything loose

Re: No "Apps Seen" / Policy Optimizer data on Panorama

SARowe_NZ — Wed, 21 Dec 2022 01:23:55 GMT

Hey - thanks for the response. I think this is resolved (has proved stable a couple of days now). What seemed to jiggle it lose was enable the free version of AI Ops on the firewalls. Not sure how that is related, or even if that is just a coincidence.

Re: No "Apps Seen" / Policy Optimizer data on Panorama

BPry — Wed, 21 Dec 2022 04:14:09 GMT

@SARowe_NZ,

Did you ensure that the device certificates were all setup and working properly when you configured the firewalls? That's the one thing within AI Ops onboarding that would cause data ingestion issues if it wasn't working properly as far as I'm aware.

Re: No "Apps Seen" / Policy Optimizer data on Panorama

SARowe_NZ — Wed, 21 Dec 2022 18:44:31 GMT

Hey yes - device certs were all good and logs were being successfully sent to CDL, and retrieved from CDL by Panorama.