Connection to Panorama for new deployment failing

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Connection to Panorama for new deployment failing

L3 Networker

Hi,

 

I have the following issue I am running panorama 10.2.7h3 my new device P440 is also running 10.2.7h3.

When I want to onboard the device into panorama it is not working.

I am onboarding the device with Authenticatio keys.

Following the below procedure.

Add a Firewall as a Managed Device (paloaltonetworks.com)

I have also reset the secure communication on the PA440  and tried removing adding the serials from panorama.

The connection doesn't come up.

In the ms.log file i am getting the following.

Seems to be related to SSL.

2024-02-14 15:49:05.844 +0100 COMM: connection established. sock=24 remote ip=10.255.125.50 port=3978 local port=54018
2024-02-14 15:49:05.844 +0100 cms agent: Pre. send buffer limit=46080. s=24
2024-02-14 15:49:05.844 +0100 cms agent: Post. send buffer limit=425984. s=24
2024-02-14 15:49:05.844 +0100 Error: cs_load_certs_ex(cs_common.c:544): keyfile not exists
2024-02-14 15:49:05.844 +0100 Error: pan_cmsa_tcp_channel_setup(src_panos/cms_agent.c:1340): cms agent: cs_load_certs_ex failed2024-02-14 15:49:05.845 +0100 cmsa: client will use default context
2024-02-14 15:49:05.846 +0100 Error: _get_current_cert(sc3_utils.c:117): sdb node 'cfg.ms.ca' does not exist ret -5
2024-02-14 15:49:05.846 +0100 Error: sc3_ca_exists(sc3_certs.c:229): SC3: Failed to get the current CA name.
2024-02-14 15:49:05.846 +0100 Warning: sc3_init_sc3(sc3_utils.c:360): SC3: Failed to get the Current CC name
2024-02-14 15:49:05.846 +0100 SC3: CA: '', CC/CSR: 'd41d48e6-c7da-4a61-8307-79ce0cc33ff7'
2024-02-14 15:49:05.846 +0100 Error: _get_current_cert(sc3_utils.c:117): sdb node 'cfg.ms.ca' does not exist ret -5
2024-02-14 15:49:05.846 +0100 Warning: sc3_get_current_sc3(sc3_utils.c:184): SC3: failed to get SNI
2024-02-14 15:49:05.846 +0100 Warning: sc3_get_current_sc3(sc3_utils.c:187): SC3: failed to get CCN
2024-02-14 15:49:05.847 +0100 Warning: sc3_init_sctx(sc3_ctx.c:302): SC3: not set, skip cert loading
2024-02-14 15:49:05.847 +0100 SC3A: using SNI (from AK): 4591c212-e525-4d70-92fb-4f5243dff4af
2024-02-14 15:49:05.847 +0100 SC3A: using sc3 ctx with no cert
2024-02-14 15:49:05.901 +0100 Error: pan_cmsa_tcp_channel_setup(src_panos/cms_agent.c:1719): panorama agent: SSL connect error. sock=24 err=5

 

Am i missing something? 

taking a pcap also show that panoram is just resetting the connection.

zGomez_0-1707923254038.png

Any help on this would be appreciated.

1 accepted solution

Accepted Solutions

Hi Pavel,

 

I have followed the above article but this did not solve my problem(first thing i tried actually).  It turned out that I needed to allow SSL on the policy as an application, it was no longer recognized as panorama on the first connection.

I really have no idea why this is and what has changed.  Since the panorama app id allow implicitly ssl on the first connection. (connection to panorma was passing multiple firewalls )

But is solved my panorama connection by allowing ssl in the policy.

View solution in original post

4 REPLIES 4

L0 Member

I am having this same problem with 10.2.6 on both Panorama and FW 3220. I just spent two days with support and they are escalating.

 

I even changed my MGMT Interface MTU as recommended by this article even though I am not seeing large packets.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wkjSCAQ&lang=en_US%E2%80%A...

Cyber Elite
Cyber Elite

Hello @zGomez 

 

it looks like you might be hitting an issue in this KB:  Managed Firewalls showing disconnected from the Panorama even though network connectivity is good. Could you check whether following this KB resolves the issue?

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

Hi Pavel,

 

I have followed the above article but this did not solve my problem(first thing i tried actually).  It turned out that I needed to allow SSL on the policy as an application, it was no longer recognized as panorama on the first connection.

I really have no idea why this is and what has changed.  Since the panorama app id allow implicitly ssl on the first connection. (connection to panorma was passing multiple firewalls )

But is solved my panorama connection by allowing ssl in the policy.

Cyber Elite
Cyber Elite

Hello @zGomez

 

thank you for reply.

 

I see. You might have been hitting an issue described in this KB: Why is traffic on port 3978 Identified as SSL application instead of Panorama application?.

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.
  • 1 accepted solution
  • 3002 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!