Notifications: WildFire Communications Status Changed

[sbessat]

Hello,

I have tried to find some topics or KB similar to the subject but didn't find any.

We recently update our Traps server to v4.1.2.31839, and from then we are spammed with these notifications:

1st

Log Event: WildFire Communications Status Changed

Time: 08.02.2018 05:16:58 (UTC)

Server Name: traps, 172.17.1.72

ESM Version: 4.1.2.31839

Status: WF communication failed. Proxy is disabled

2nd

Log Event: WildFire Communications Status Changed

Time: 08.02.2018 05:18:13 (UTC)

Server Name: traps, 172.17.1.72

ESM Version: 4.1.2.31839

Status: WF communication established. Proxy is disabled

Is there something wrong, something to set in our server to make it works? Is there a problem with the communication with WildFire?

Thank you for your help,

[wtobar]

Hello @sbessat!

I saw that event in my console, but in my case that happend when my network has some latency but that not impact in agents protection.

Regards,

wtobar

[sbessat]

Thank you @wtobar, I understand there are not impact on agents protection, but before the last software update, we didn't receive as many notifications about that than today.

That's why I was wondering if we need to take action on some server settings to resolve somme issue.

[wtobar]

Hi @sbessat I just check my security alerts and saw only 4 events starting on jan about that issue, but for network latency, I use 4.1.2 version on ESM and some agents, may you requiere submit case to paloaltonetworks support if your events are continues or higher.

Regards,

wtobar

[JNK_90]

Hi,

I got the same issue (same day, same events). After the 08.02. these notifications were reduced to only two or four a day.

Today I have opened a case to analyze the root cause of this issue.

@sbessat Have you opened a case as well? Do you have first PAN support results?

Thanks and best regards,

Jan

[sbessat]

Hello,

I haven't opened a case yet, but I checked and as you, fom the 08.02, the notifications have considerably decreased.

As there was a problem from the WildFire service side and they are on the way to resolve it.