All the traps agents are disconnected

[Abdul_Razaq]

Hi Community,

All the agents in my traps setup on ver 4.2.5 shown as disconnected. As the issue looks like ESM server related, i have followed the document https://docs.paloaltonetworks.com/traps/4-2/traps-endpoint-security-manager-admin/troubleshooting/tr... but no luck. i cannot navigate to agent installation package page as well in ESM console.

i can see the agents as 'connected to server <>' in agent console but having the last check in time much older.

I can see there are multiple established connections on 2125 port on ESM core using netstat.

Any info on what will be the reason for this behaviour ?

Thanks in advance!.

[BPry]

@Abdul_Razaq,

That really sounds like an ESM issue, or a compatibility issue between your ESM and the agent version. Regardless, if you've already gone through that document and can't find the issue I would open up a TAC case so they can look over your ESM server.

[Abdul_Razaq · Accepted solution]

Hi @BPry ,

Thanks for your input.

I have checked the ESM and i were able to see two entries  for same server under Multi ESM (one was in inactive state), i just disabled one of them which were duplicate, post this i can see the agents are getting online and everything works fine.

Even though it looks illogical, can we have two core instance on same server ?. i am not sure how it got added even.

EDIT:- This was the issue, looks like somebody changed the server table in the traps DB, which added one more entry of same core server, it was causing all mess. post deleting the duplicate entry, everything is fine