Broker VM offline in Cortex XDR

[weejh]

Hello

I've a broker VM that is offline in Cortex XDR, do I need to remove the offline broker VM from Cortex XDR then register it?

[neelrohit · Accepted solution]

Hi @weejh ,

Thank you for writing to live community!

You do not need to remove the broker VM. Please ensure the broker VM gets connectivity on network side or check if it is powered on. If the connectivity to the cloud is restored, you should have the broker VM up and connected again.

Hope this helps!

Regards

[weejh]

Thanks

[Shahwaz_Md]

Hi @neelrohit ,

We are facing a similar issue where one bvm is showing as disconnected, also a couple of servers where this bvm was set as the proxy are connected and has it in the last good proxy as well.

[neelrohit]

Hi @Shahwaz_Md , 

Please collect the broker vm logs and reach out to the support team. You also might want to ensure if the network firewalls are limiting the connection from broker vm causing it to temporarily go down.

[Shahwaz_Md]

So basically we have to check whether XDR-related IPs are reachable or not from the bvm server, please correct me if I'm wrong.

[neelrohit]

That is correct. You can even do this by live terminal or even SSH to the broker vm.

One of the other tests you can perform is  as below:

openssl s_client -connect br-<xdr-tenant subdomain>.traps.paloaltonetworks.com:443