topic Re: Failed to establish SSL connection to Panorama Server in General Topics

Failed to establish SSL connection to Panorama Server

tormodhope — Mon, 19 Sep 2016 11:55:26 GMT

I upgraded a PA200 from 7.0.5 to 7.1.3 on friday.

After the upgrade, the box show a MGT CPU load average on >80% and is not able to connect to Panorama anymore.

The box is rebooted twice adter upgrade to try to fix this. Anyone know a fix?

Re: Failed to establish SSL connection to Panorama Server

glastra1 — Mon, 19 Sep 2016 12:07:35 GMT

Is the traffic passing through the dataplane? If that's the case maybe you're the next document can help you out.

https://live.paloaltonetworks.com/t5/PAN-OS-7-1-Articles/PAN-OS-7-1-Policy-behavior-change-application-default/ta-p/75664

Re: Failed to establish SSL connection to Panorama Server

TranceforLife — Mon, 19 Sep 2016 12:31:24 GMT

Hi,

Did you try to access cli and check what process is running high:

> show system resources follow

Cheers,

Myky

Re: Failed to establish SSL connection to Panorama Server

tormodhope — Tue, 20 Sep 2016 07:21:54 GMT

EDIT: Wait.. Let me read the post from glastra1 first! 🙂

I did remove application-default from the interface after some trouble yesterday, that have probably fixed it then..

Weird, as application is "any".. It should have let Panorama thought?

Re: Failed to establish SSL connection to Panorama Server

reaper — Tue, 20 Sep 2016 08:17:12 GMT

panorama uses ssl on a non standard port, the application is also dependent on ssl (this means ssl needs to be allowed also)

there could have been a condition where, because there is app-default configured and also a very short security policy, appid was a little too fast and tagged panorama traffic as ssl on a non-default port and rejected it

if this persists you should reach out to TAC to have the AppID verified, but this will probably solve itself once you have a slightly larger security policy