Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

No valid AceMlc2 config: SC 1 (AceMlc2): Config not valid

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

No valid AceMlc2 config: SC 1 (AceMlc2): Config not valid

L0 Member

Hello all,

I need some help troubleshooting these low severity logs that keep popping up.

 

This is happening on a PA-3220 which is running 10.2.9.

 

The output of show ctd-agent status security-client is:

[snip]

Security Client AceMlc2(1)
Current cloud server: ace.hawkeye.services-edge.paloaltonetworks.com:443
Cloud connection: disconnected
Config:
Number of gRPC connections: 2, Number of workers: 6
Debug level: 2, Insecure connection: false, Cert valid: true, Key valid: true, CA count: 385
Maximum number of workers: 10
Maximum number of sessions a worker should process before reconnect: 1024
Maximum number of messages per worker: 0
Skip cert verify: false
Grpc Connection Status:
State Invalid Config (8), last err SC 1 (AceMlc2): Config not valid
Pool state: Invalid Config (7)
last update: 2024-09-27 11:11:24.801152042 +0200 CEST m=+4233846.308952506
last connection retry: 2024-09-27 11:11:24.801135605 +0200 CEST m=+4233846.308936058
last pool close: 2024-08-09 11:09:08.896545095 +0200 CEST m=+112.772251674
isProxy: false

[/snip]

 

I did not find any useful documentation on how to understand what's not working and how should I fix it.

So far i got that it's about cloud features of Vulnerability Protection but it seems it's not enabled on the software version I am using.

Any other hint or suggestion is appreciated.

3 REPLIES 3

L0 Member

Hello I had the same problem on the passive PA in my cluster
licenses ok,   "debug software restart process ctd-agent" or firewall restart does not change anything.
but when I suspended the active one,  magic, the problem disappear,  confirming that my configuration (network, service route configuration and other) was correct.

 

have a nice day

Cyber Elite
Cyber Elite

@P.Pozzan,

If you're looking at a passive firewall that doesn't have an internet connection through the management interface and relies upon a service route this is kind of expected, which is why it's a low severity alert.

Thanks @BPry but this is happening on the active firewall.

All services are running as intended.

The firewall has access to internet.

  • 1010 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!