XDR agent on ... failed to communicate to the server via proxy

[jbhamant]

Hello,

I am a bit confused by the information in logs when an XDR enpoint is connected to a BrokerVM.

It appears that for some connexions issues, endpoints are not communicating anymore with the BrokerVM:

XDR agent on ... failed to communicate to the server via proxy

1) There isn't any Endpoint log confirming that the endpoint could reconnect to the BrokerVM.

Is there a solution for this ?

2) In case the BrokerVM isn't reachable, the agent is using Internet breakout if not disabled in Agent Setting Profile.

Is there any way to know if an endpoint is using BrokerVM or Internet Breakout connectivity ??

Thank you

[dbahuguna]

Hi @jbhamant ,

Thank you for writing to Live Community. 

You may run the following commands to verify if endpoint is using agent proxy of broker VM:
Windows:
C:\Program Files\Palo Alto Networks\Traps>cytool proxy query
Mac:
Sudo /Library/Application\ Support/PaloAltoNetworks/Traps/bin/cytool proxy query
Linux
/opt/traps/bin/cytool proxy query

Also, the BVM IP address and port should be listed under Last good Proxy in the command output. If there is no Last Good Proxy, it means your agent cannot connect to Broker VM .If Proxy server is not configured properly, you can run this command to configure Proxy.“cytool proxy set X.X.X.X:YYYY”*replace X.X.X.X with BVM IP address and YYYY with BVM port.

For more information you may refer to the below discussion:

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/broker-vm-and-connection-to-the-agents-v...

Hope this helps.

Please mark the response as "Accept as Solution" if it answers your query.

[jbhamant]

Thanks for your feedback.

If there is no Last Good Proxy, it means your agent cannot connect to Broker VM

Even if the agent already connected to the BVM and cannot connect after a network issue ?

I'm not sure it answer my question of knowing if an agent is reaching the console through BVM .

In the console, you have the information of the number of current connectivity, but not the listing of connected endpoints.