API calls to Azure failing

[Pras]

Hi All,

We have a setup to turn-on and turn off VPN from Palo VM to Azure (at a specific time daily) but recently the tunnels are not coming up. Seems like the API calls are not being received at the other end. This setup was working before but stopped all of a sudden. VM is on 10.1.4 and I do not see any bugs addressed on the higher version. Where do I check the communication logs from the VM to the Azure in the TSF or in the Logs within GUI?

Rather how do I start my troubleshooting?

error: "curl -X GET "https://xxxxxxxxxxx.........."  -H "Authorization: Basic <EncodedCredentials>" --ssl-no-revoke --insecure "

Thanks,

@BPry 

@kiwi 

[OtakarKlier]

Hello,

Is there a reason why the VPN is not full time? My guess is that there is not enough time to establish the tunnel before the API performs its calls and timeouts.

Regards,

[Pras]

Hi @OtakarKlier ,
Its not full time because of security purposes. As said, it was working all good for many months and stopped all of a sudden. Calls out and time out is like six hours apart, so should be fine I guess. Where can I see the logs for the API communication in the TSF apart from the monitor logs? I can only see VPN msgs there.

I am confused as to where to start troubleshooting.

P.s API admin gets successfully authenticated but unable to establish the VPN

I do not see any such bugs identified

Thanks,

[BPry]

@Pras 

php.debug.log is the file that you are looking for. The API requests can be sorted by searching for client='xmlapi'. 

When you say that it's unable to bring up the tunnel, is it enabling things properly assuming that you're disabling them to bring them down and just not establishing? 

[Pras]

Thanks guys,

I can see the the API calls stopping with error msgs as below: 

It has UTC timings, not sure if this is PAN error or something else. All I could find in the latest php.debug was this but in the old ones i could see all the api calls happening successfully.

Does this look like a pan issue to you?

[BPry]

@Pras,

UTC is expected here. I would walk through the calls that you are making individually outside of a script and just make them directly and verify that everything is working properly. Certainly looks like something isn't formatted properly,not sure if PHP startup errors are anything to worry about, looks like the process may have just been recycled. 

[Pras]

Seems like the problem started ever since the Curl Patching was done. If there a known solution or steps on Palo for this?