Hi,
Can you these given ports as per your connectivity between FWs and Panorama. And same time can you check the logs
in >monitor>loigs>system level
example"
On Firewall:
show panorama status
On Panorama:
show devices all
verify both commands.
Panorama APP-ID: When the managed firewall communicates with Panorama, by default this traffic is sent over the MGT interface. Because traffic leaving the MGT interface of the firewall is not subject to a Security policy check, no additional Security policy rule configuration is necessary.
However, in some deployments, the administrator might choose to send management traffic through one of the data-plane interfaces of the firewall. In this case, remember to create a Security policy rule to allow the Panorama application. Otherwise, the firewall denies communications with Panorama.
and try to see reachability:
Use ping from the firewall or Panorama command line ping count <integer> source <IP-address> host <IP-address
and try pcap on mgmt using tcpdump
•Run tcpdump from the command line of Panorama or the firewall to capture the traffic. When you have enough data, press Ctrl+C to stop the capture.
Example: tcpdump filter “host 10.1.10.10
Hi,
I am using dataplane port instead of Management as the connection to panorama is anyway over the IPSec VPN connection.
The coresponding Firewall rules are applied on both Firewalls and they are passing the traffic on this ports. Also ping works fine.
From Firewall: show panorama-status
Panorama Server 1 : 192.168.1.20
Connected : no
HA state : disconnected
From Panorama: show devices all
Serial Hostname IPv4 IPv6 Connected
--------------------------------------------------------------------------
00000000XXXX no
Wildfire Real-time Stream Disabled VPN Disable Mode: no
Operational Mode: normal
Certificate Status:
Certificate subject Name:
Certificate expiry at:
Connected at:
Custom certificate Used:
Last masterkey push status: Unknown
Last masterkey push timestamp: none
Express mode: no
Device cert present :
Device cert expiry date : N/A
I run also a PCAP and I can see on panorama and also on Firewall traffic from the oposite side.
I also check all this from this checklist:
1. IP connectivity is there
2. Port 3978 and also others required for panorama are open
3. DeviceCert on Panorama installed
4. Serial number of device is correct
5. Management profile set up on this interface used for communication
6. Panorama is on version 10.2, Firewall 10.1.4
7. MTU on tunnel interface lowered
8.Time synchronized using NTP
What else I can check?
Hello Pavel,
1. netstat is showing no match, so no TCP connection on this port is established.
2. When I access panorama IP on port 3978 I will get window to select which certificate I want use to authenticate myself
After I click on OK, I see that panorama is using self-signed cert issued to localhost
3. In log only entry like this was found with the serial of the FW
2022-03-02 15:22:45.032 +0100 String is <devices>
<entry name="000000000001"/>
<entry name="000000000000"/>
</devices>
2022-03-02 15:22:45.032 +0100 After str: <devices>
<entry name="000000000001"/>
<entry name="000000000000"/>
</devices>
Hi Pavel,
if you mean cert on https port 3978, I am getting this.
It is issued to my panorama IP address.
