Frequently encountered problems in Onboarding AIOps

[svenkatarama]

Problems with activating the Free tier of AIOps? In general, it is due to something trivial that has been overlooked. Based on our beta program, these were the top 3 reasons customers usually had issues in standing up an instance of the Free tier of AIOps.

1. During AIOps activation flow, there is no CDL tenant in the drop-down list to point to.

If the customer is not already a Cortex Data Lake (CDL) logging service customer, a new telemetry-only CDL instance is created for them when telemetry from the first firewall appears. Telemetry generation and sending on the device's side is a batch process, and it may take as much as 2 hours from the time the user turns on telemetry on the PAN-OS 10.0+ device for the CDL instance to be created. Please check back in a little while to see if the instance exists.

2. The "Activate" button is missing on the Hub (https://apps.paloaltonetworks.com) for the user.

This hub requires the user to have App Admin privileges to enable the instantiation of the AIOps app. Please use the gear icon on the top right, under Manage Permissions to assign the user App Admin privileges to instantiate AIOps

3. The firewall data is not showing up in the App.

A few things could be happening here - we have seen customers hit these issues -

• The user is not on the PAN-OS 10.0 or later.
• The user thinks they have started the telemetry process, but the commit did not complete. Check the UI on the firewall (Device>Setup>Telemetry) to see if it is reporting success/error messages
• There is a firewall/proxy upstream that blocks the telemetry traffic. Check the app-ids and FQDNs required for device telemetry here and enable them on the upstream device
  • https://docs.paloaltonetworks.com/aiops/aiops-for-ngfw/get-started-with-aiops/fqdns.html
  • https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-start...

[Brian-Thomas]

Here's another issue, which we are currently facing: AIOps for NGFW app was created following documented procedure.  After creating, maybe 10 or 15 minutes passed and the Instance Status shows red exclamation point icon. When hovering over the icon it pops up message "Status: Error", but gives no other information.  What does this mean?

NGFW certificates are correctly installed. CDL for telemetry data is created and showing firewalls as connected.

[OTF_JKeubke]

I'm getting the exact same error after activating the App on 5/18/2022.  Palo support informed me to reach out the live community to get help.

[ebenny]

Hi @OTF_JKeubke , There was an issue on the backend the other day which was preventing instance creation, it is been resolved and it will work as expected from now onwards

Edison K Benny

Product specialist

Palo Alto Networks

https://live.paloaltonetworks.com/t5/cloud-ngfw-help-center/ct-p/Cloud_NGFW 
*Don’t forget to accept the solution provided!*

[bmartinsmm]

I seem to be having the issue you described in step 1. It's been 2 days and no CDL instance is showing on the AIOps app dropdown selection. When I attempted to enter the a support request for AIOps on at support.palotaltonetworks.com, I was directed to the Livecommunity. 

Any advice on how I should proceed?

[Jason_Lieberman]

I am seeing a new error where it says that telemetry data is not being sent for the past week but when I look at activity/log viewer, the logs are current.