Failed to establish SSL connection to Panorama Server

[tormodhope]

I upgraded a PA200 from 7.0.5 to 7.1.3 on friday.

After the upgrade, the box show a MGT CPU load average on >80% and is not able to connect to Panorama anymore.

The box is rebooted twice adter upgrade to try to fix this. Anyone know a fix?

[glastra1 · Accepted solution]

Is the traffic passing through the dataplane? If that's the case maybe you're the next document can help you out.

https://live.paloaltonetworks.com/t5/PAN-OS-7-1-Articles/PAN-OS-7-1-Policy-behavior-change-applicati...

[TranceforLife]

Hi,

Did you try to access cli and check what process is running high:

> show system resources follow

Cheers,

Myky

[tormodhope]

EDIT: Wait.. Let me read the post from glastra1 first! 🙂

I did remove application-default from the interface after some trouble yesterday, that have probably fixed it then..

Weird, as application is "any".. It should have let Panorama thought?

[reaper]

panorama uses ssl on a non standard port, the application is also dependent on ssl (this means ssl needs to be allowed also)

there could have been a condition where, because there is app-default configured and also a very short security policy, appid was a little too fast and tagged panorama traffic as ssl on a non-default port and rejected it

if this persists you should reach out to TAC to have the AppID verified, but this will probably solve itself once you have a slightly larger security policy