topic Re: Device Telemetry to Cortex Data Lake in General Topics

Device Telemetry to Cortex Data Lake

duccio — Thu, 18 Apr 2024 19:00:34 GMT

Hello,

just finished to setup Cortex Data Lake on my PA-220 (without Panorama, using the Hub).

After enabling Telemetry (as asked by 10.0.1) and setting up the Telemetry Region as my Cortex Data Lake region (Europe) the status for Device, Product and Threat is always "Failed" with message "CDL Receiver Destination URL Empty".

On "device_telemetry_send.log" I can see:

2020-09-29 22:00:06,807 dt_send ERROR dst server: set endpoint: region not found on region list.
2020-09-29 22:00:06,810 dt_send ERROR fqdn lookup: endpoint url is empty

Where can I set the endpoint?

Thanks!

Re: Device Telemetry to Cortex Data Lake

duccio — Tue, 29 Sep 2020 21:53:18 GMT

More info...

Doing a

show system state filter-pretty cfg.device-telem

I obtain:

cfg.device-telem: { collect-now: { last-attempt: Tue Sep 29 22:03:16 CEST 2020, last-filename: PA_012801171939_dt_10.0.1_20200929_2004_NOW.tgz, last-request-id: 1601409794, last-success: Tue Sep 29 22:03:16 CEST 2020, latest-request-id: 1601409794, num-of-failed-attempts: 0, reason: N/A, status: N/A, }, collect-now-canceled: 0x0, collect-now-progress: 0, collect-now-trigger: 0, collect-now-ts: 26690168, config-reload: 0x0, dest-server: { cacert: /tmp/capath/not-used, capath: /tmp/capath, client-cert: /opt/pancfg/mgmt/ssl/private/012801171939.crt, client-cert-path: /opt/pancfg/mgmt/ssl/private, client-cert-type: CRT, dest-server-ip: 0.0.0.0, endpoint: , private-key: /opt/pancfg/mgmt/ssl/private/012801171939.key, region: europe, use-endpoint: True, use-lcaas-cert: False, }, dest-server-ip: 0.0.0.0, enabled: True, intvl-resend-failed-count: 2, logging-services: { enabled: no, endpoint: , region: americas, }, minute-count: 0x89c3, region-list: { Americas: { endpoint: br-prd1.us.cdl.paloaltonetworks.com, region: Americas, }, Europe: { endpoint: br-prd1.nl.cdl.paloaltonetworks.com, region: Europe, }, UK: { endpoint: br-prd1.uk.cdl.paloaltonetworks.com, region: UK, }, }, schedule: { 20-min-interval: { day_intvl: None, hour_intvl: None, minute_intvl: 0, 20, 40, name: 20-min-interval-schedule, type: minute, }, 4-hr-interval: { day_intvl: None, hour_intvl: 0, 4, 8, 12, 16, 20, minute_intvl: 7, name: 4-hr-interval-schedule, type: hour, }, 7-day-interval: { day_intvl: 0, hour_intvl: 1, minute_intvl: 7, name: 7-day-interval-schedule, type: day, }, }, schedule-list: { day: { 7-day-interval: 7-day-interval, }, hour: { 4-hr-interval: 4-hr-interval, }, minute: { 20-min-interval: 20-min-interval, }, }, send-failed-count: 73, send-settings: { failed_retry_interval: 10, fqdn-interval: 10, interval: 60, max_failed_retries: 3, multi-send-per-hour: 0, }, settings: { device-health-performance: yes, product-usage: yes, region: europe, status: Device Certificate is valid, threat-prevention: yes, }, stats: { device-health-performance: { last-attempt: Tue Sep 29 23:47:04 CEST 2020, last-success: N/A, num-of-failed-attempts: 74, reason: CDL Receiver Destination URL Empty, status: failed, }, product-usage: { last-attempt: Tue Sep 29 23:47:04 CEST 2020, last-success: N/A, num-of-failed-attempts: 74, reason: CDL Receiver Destination URL Empty, status: failed, }, threat-prevention: { last-attempt: Tue Sep 29 23:47:04 CEST 2020, last-success: N/A, num-of-failed-attempts: 74, reason: CDL Receiver Destination URL Empty, status: failed, }, }, system-info: { minute-count: 0x43, timestamp: 2020/09/05 01:37:01, }, username-required: { day: 0, hour: 0, man: 0, minute: 0, now: 0, }, }

Re: Device Telemetry to Cortex Data Lake

tabner — Tue, 06 Oct 2020 18:11:31 GMT

I have the same issue.

Re: Device Telemetry to Cortex Data Lake

mdensley — Mon, 30 Nov 2020 18:15:07 GMT

Same issue for me too! It'd be nice to have TAC or PM chime in here on what the issue might be!

Re: Device Telemetry to Cortex Data Lake

tabner — Mon, 30 Nov 2020 18:45:38 GMT

FYI...I got mine working. Part of the issue is that there is a bug where the region being pushed from Panorama is set to "americas" instead of "Americas". I had to change it via CLI after doing a local override. You can check by:

show device-telemetry settings

If it shows "americas" then you have the issue and need to manually set it to Americas:

set deviceconfig system device-telemetry region Americas

You will have to do a local override first since Panorama is managing that setting prior. Hope this helps.

Re: Device Telemetry to Cortex Data Lake

mdensley — Thu, 08 Apr 2021 18:47:05 GMT

My issue was related to the type of support license that was assigned to my firewall. I had to have that fixed by the licensing folks. The error message was 100% unrelated to my real issue. Seems like only one error message exists that gets displayed regardless of what the true underlying issue is.

Re: Device Telemetry to Cortex Data Lake

MMadrala — Fri, 24 Mar 2023 13:10:48 GMT

Hi,

I had this problem before and it has to do with Device Certificate. If you notice, on the WebUI, it shows valid and that was the case for me. However, if you go to cli and run:

admin@PA-460> show device-certificate status

It might show otherwise or that it wasn't fetched.

I just had to run:

admin@PA-460> request certificate fetch

and it helped.

Re: Device Telemetry to Cortex Data Lake

SalvatoreG — Tue, 15 Aug 2023 07:03:40 GMT

You saved my day! Thank you!