topic Re: Telemetry error - CDL Receiver Key Empty in General Topics

Telemetry error - CDL Receiver Key Empty

Ben-Price — Tue, 04 Jan 2022 00:30:34 GMT

Hi All,

We have a client who all of a sudden started to receive the following telemetry error - 'CDL Receiver Key Empty' on PA-440. No changes have been made. Currently running PAN OS 10.1.2. They are not using CDL and are just sending Telemetry data to PA with a certificate. This looks like it may be a an issue on the PA backend.

Can anyone clarify? @BPry ?

Thanks in advance.

Re: Telemetry error - CDL Receiver Key Empty

BPry — Tue, 04 Jan 2022 02:05:04 GMT

@Ben-Price,

That error has never been incredibly well defined. I've seen it caused by backend licensing issues that needed support to fix the licensing on their end, and I've seen it being caused by blocking licensing traffic from the firewall. I'd start with basic troubleshooting to kick things off (has the device been restarted, verify via logs the traffic is being allowed, etc) and go from there.

Re: Telemetry error - CDL Receiver Key Empty

Ben-Price — Mon, 10 Jan 2022 00:54:36 GMT

@BPry

Firewall did not receive the signed URL key required back from PAN servers to upload telemetry data (based on the telemetry logs), which looks to have caused the error. Also, the firewall failed to fetch the device certificate correctly upon 3 month renewal. Rebooted firewall and waited 24 hours and the firewall was then able to retrieve the certificate and telemetry data began to flow successfully again.

Looked to have been an issue with the Palo Alto back end as no changes were made on the firewall except a reboot, but am not quite sure.

Re: Telemetry error - CDL Receiver Key Empty

Pras — Thu, 10 Feb 2022 00:17:00 GMT

@BPry I conducted the reboot and telemetry started up again however it has since stopped again.

Any help would be much appreciated. Thank you in advance.

Re: Telemetry error - CDL Receiver Key Empty

BPry — Thu, 10 Feb 2022 03:05:39 GMT

@Pras,

You'd probably want to report it to TAC to help investigate why you keep running into issues and bring up that it's failed multiple times requiring a restart. A simple restart will likely fix it again, but there could be a communication issue due to your configuration or it could simply be a bug within PAN-OS 10.1 that you're running into.

If you haven't already, I would install 10.1.4 to ensure you're at least running the latest release. I don't see anything in the release notes to actually address an issue that would point towards your issue.

Re: Telemetry error - CDL Receiver Key Empty

SMcGregor — Thu, 12 May 2022 00:41:24 GMT

I had the same issue when I installed 10.2.0. Reboot didn't fix it, and installing 10.2.0-h1 didn't fix it either. Just installed 10.2.1 and after a couple hours it finally started working. Fingers crossed it is now resolved.

Re: Telemetry error - CDL Receiver Key Empty

Jason_Lieberman — Mon, 17 Oct 2022 02:38:46 GMT

I have this same issue on 10.1.6-H6 and thus far a reboot has not fixed it. Shows my device cert is good and CDL is showing current logs. But AIOps stopped getting telemetry data about a week ago.

I also see

Re: Telemetry error - CDL Receiver Key Empty

ngagne — Tue, 18 Oct 2022 18:39:45 GMT

I'm experiencing the same issue you are (with the exception that my device cert is valid) with my firewalls that are running 10.1.6-h6 (2x 220s and a VM), but not on those running 10.1.4 (2x 820s). I just enabled aiops today.

Re: Telemetry error - CDL Receiver Key Empty

Jason_Lieberman — Tue, 18 Oct 2022 19:46:53 GMT

Here is what fixed it for me.

https://live.paloaltonetworks.com/t5/general-topics/failed-to-renew-device-certificate/m-p/518094/highlight/true#M107486

Re: Telemetry error - CDL Receiver Key Empty

AaronAxvig — Thu, 19 Jan 2023 17:10:02 GMT

My PA-3430 devices running 10.2.3-h2 had this issue. Device certificate was a week away from expiring but still causing the CDL error apparently.

request certificate fetch

Fixed the issue.

Re: Telemetry error - CDL Receiver Key Empty

LCMember17013 — Tue, 14 Feb 2023 20:02:18 GMT

When I try to place a TAC case, it is redirecting me to the live community. How do I submit a ticket?

Re: Telemetry error - CDL Receiver Key Empty

AaronAxvig — Tue, 14 Feb 2023 20:08:03 GMT

There is a very unfriendly feature of the case opening tool where it does this for certain categories, basically telling you in an insulting and passive aggressive manner that your need is too petty to concern regular support staff. (Isn't it nice how you can spend a ton of time typing up your situation into the case notes and then on submit BAM it redirects you do the forum and throws out all your typing?)

Choosing a "better fitting" category / issue type / whatever may allow you to open the ticket.

Re: Telemetry error - CDL Receiver Key Empty

AaronAxvig — Tue, 20 Jun 2023 13:51:38 GMT

This is now listed as a known issue in the release notes of 10.2.4.

======================

PAN-208325

The following NextGen firewalls and Panorama management server models are unable to automatically renew the device certificate (

Device

Setup

Management

Panorama

Setup

Management

M-300 and M-700
PA-410 Firewall
PA-440, PA-450, and PA-460 Firewalls
PA-3400 Series
PA-5410, PA-5420, and PA-5430 Firewalls
PA-5450 Firewall

Workaround:

admin>

request certificate fetch

======================

Re: Telemetry error - CDL Receiver Key Empty

ngagne — Tue, 20 Jun 2023 14:35:46 GMT

We were finally able to get telemetry sent to AIOps by permitting google-base as per this article.

Re: Telemetry error - CDL Receiver Key Empty

DannyNg_HDB — Sun, 27 Oct 2024 03:11:10 GMT

Exactly!!!

Thanks alot.