Failed to fetch ingest/query FQDN for customer (curl failed)

[LukeBullimore]

Hi Team,

I'm trying to onboard one of our firewals to the Cortex Data Lake. It has the logging service license and when I put in the onboarding PSK and click status, I get:

Failed to fetch ingest/query FQDN for customer (curl failed)

I've tried

- Giving the firewall an NTP server

- Removing and re-adding the license

- Manually fetching the certificate (it fails)

> request logging-service-forwarding certificate fetch

Successfully scheduled logging service certificate fetch job with a job id of 2132

> show jobs id 2132

Enqueued Dequeued ID Type Status Result Completed
------------------------------------------------------------------------------------------------------------------------------
2019/10/14 10:18:24 10:18:24 2132 LCaaS-certificate-fetch FIN FAIL 100 %
Warnings:
Details:

- Manually fetching the customer info (it fails)

> request logging-service-forwarding customerinfo fetch

Successfully fetch Logging Service region info

> request logging-service-forwarding customerinfo show

Server error : Unable to read the LCaaS customer information. Please re-fetch region info

[Chacko42 · Accepted solution]

@LukeBullimore: Yes, TAC case already closed. If you are not on 9.0.4 or 8.1.13 (not available yet), you need to contact TAC to set the tenant-id for cortex/logging service.

Problem is fixed in the versions mentioned above - no workarounds available, so TAC creates root access to device and edits local files on each firewall

[Chacko42]

Hi - I'm experiencing exactly the same error and opened a TAC case for this.

Do you got any feedback on your situation?

[cdowdy]

Same here.. Guess I'll be opening one as well.

[LukeBullimore]

@cdowdy @Chacko42 

Did you both get anything useful from your TAC case? This is still a problem for us and its fallen off my radar up until now.

Cheers,

Luke.

[Chacko42 · Accepted solution]

@LukeBullimore: Yes, TAC case already closed. If you are not on 9.0.4 or 8.1.13 (not available yet), you need to contact TAC to set the tenant-id for cortex/logging service.

Problem is fixed in the versions mentioned above - no workarounds available, so TAC creates root access to device and edits local files on each firewall

[cdowdy]

Yep, did that on Friday. Easy fix for TAC with root.  

[root@XXXXXXXXX ~]# sdb -i cfg.saas.custid
cfg.saas.custid: string (10 bytes)
[root@XXXXXXXXX ~]# sdb cfg.saas.custid=None
cfg.saas.custid: None
[root@XXXXXXXXX ~]# sdb cfg.saas.custid=123456789
cfg.saas.custid: 123456789
[root@XXXXXXXXX ~]# sdb -i cfg.saas.custid
cfg.saas.custid: int (len 4)

re-license FW's from Panorama

Finally, on each fw:

request logging-service-forwarding certificate delete

request logging-service-forwarding certificate fetch