No "Apps Seen" / Policy Optimizer data on Panorama

[SARowe_NZ]

Hi,

We have a new deployment of Panorama using Datalake storage.

Log data from the firewalls is successfully coming through to Panorama, however, there is no "Apps Seen" or info shown for apps under Policy Optimizer.

Rule Usage data is available, and the app data is shown correctly on the local firewalls.

Setup > Management > Policy Rulebase Settings > Policy Application Usage is ticked on the firewalls and on Panorama.

Any ideas before I log it with TAC?

Thanks,

Shannon

[reaper]

Did you check if all ports between the firewalls and panorama are open in the right direction? https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/firewall-administration/reference-port-nu...

You may try to restart panorama to see if that 'jiggles' anything loose

[SARowe_NZ]

Hey - thanks for the response. I think this is resolved (has proved stable a couple of days now). What seemed to jiggle it lose was enable the free version of AI Ops on the firewalls. Not sure how that is related, or even if that is just a coincidence.

[BPry]

@SARowe_NZ,

Did you ensure that the device certificates were all setup and working properly when you configured the firewalls? That's the one thing within AI Ops onboarding that would cause data ingestion issues if it wasn't working properly as far as I'm aware. 

[SARowe_NZ]

Hey yes - device certs were all good and logs were being successfully sent to CDL, and retrieved from CDL by Panorama.