Device Disconnected from Panorama

s.williams1 — Wed, 20 Sep 2017 11:59:52 GMT

I added the Device yesterday to Panorama and everything was fine. Logs were shipping to Panorama from device as expected and at about 9:50 PM, I see a stop in the logs so I assume the device became disconnected at that point. From the device I can ping the Panorama so connectivity is there. No changes were made last night.

What else can I check?

Re: Device Disconnected from Panorama

kiwi — Wed, 20 Sep 2017 12:21:03 GMT

Hi @s.williams1,

There are a couple of checks you could perform.

I'd start by verifying that the device & panorama have connectivity, i.e.:

On Device

admin@PA-4050> show panorama-status

Panorama Server 1 : 10.30.1.134

State : Unknown

Verify logrcvr status on the device:

admin@PA-4050> show system software status | match logrcvr

Process logrcvr running (pid: 1606)

Restart may be required if not running.

On the device verify logs are being actively written to the appliance, forwarding, etc..:

admin@PA-4050> debug log-receiver statistics

Logging statistics

------------------------------ -----------

Log incoming rate: 30/sec

Log written rate: 30/sec

Corrupted packets: 0

Corrupted URL packets: 0

Logs discarded (queue full): 0

Traffic logs written: 7071520

URL logs written: 725

Anti-virus logs written: 0

Spyware logs written: 0

Attack logs written: 0

Vulnerability logs written: 0

Fileext logs written: 2993

URL cache age out count: 440

URL cache full count: 0

Traffic alarms dropped due to sysd write failures: 0

Traffic alarms dropped due to global rate limiting: 0

Traffic alarms dropped due to each source rate limiting: 0

Traffic alarms generated count: 0

Log Forward in queue count: 0

Log Forward count: 7070916

Log Forward discarded (queue full) count: 0

Log Forward discarded (send error) count: 0

On Panorama (verify if devices are connected):

admin@Panorama> show devices connected

Serial Hostname IP Connected

--------------------------------------------------------------------------

0001A100236 PA-4050 10.30.14.80 yes

Verify logging status on Panorama (last log forwarded from device, etc...):

admin@Panorama> show logging-status device <device_serial_number>

Type Last Log rcvd Last SeqNo. rcvd Last Log generated

config 2017/04/03 18:02:01 145 2017/01/19 16:12:17

system 2017/03/30 11:18:01 15835 2017/01/19 16:13:49

threat

traffic

hipmatch

If there is a gap in logging (logs not forwarding to Panorama) & connectivity to/from devices does not appear to be an issue, etc…, you could issue the following commands in sequence on Panorama via CLI to restart the log-forwarding process :

request log-fwd-ctrl device <serial number> action stop
request log-fwd-ctrl device <serial number> action live (let this run for about 1 minute or so & verify logging-status)
Note:Think of "action live" as a function similar to UDP syslog/best-effort. In this mode, there will be no sanity checks/lost log checks, etc... Logging is literally "live" with no buffering.
Finally, issue the following command: request log-fwd-ctrl device <serial number> action start
Note: Action Start (default behavior) is buffered log forwarding. Reasoning behind the buffering is for Panorama to perform various checks (lost log checks, etc...), from last acked, etc...

Afterwards, issue the following command from CLI on Panorama as well as verify via the WebUI/Monitor tab:

admin@Panorama> show logging-status device <device_serial_number>

Type Last Log rcvd Last SeqNo. rcvd Last Log generated

config 2017/04/19 20:02:01 235 2017/04/19 20:00:17

system 2017/04/19 12:18:01 19935 2017/04/19 12:08:49

threat

traffic

hipmatch

Hope this helps,

-Kiwi.

Re: Device Disconnected from Panorama

s.williams1 — Wed, 20 Sep 2017 12:32:47 GMT

All checks out. The device shows disconnected so it doesnt show ip in many outputs. The logs are running good ont he local device just not connected to Panorama so therefore not forwarding.

From device I can ping Panorama, and Panorama I can ping device, no firewalls are in between.

Silly question, but can a device that is currently not on support be managed in the Panorama?

The only thing I see in the logs is the Panorama going out to updates.paloaltonetworks.com and doing some kind of deployment job update license task?

topic Re: Device Disconnected from Panorama in General Topics

Device Disconnected from Panorama

Re: Device Disconnected from Panorama

Re: Device Disconnected from Panorama