Logging service license not assigned from Panorama to FW

[nikoo]

There's deployment with Panorama and currently one HA PA pair managed by it. Panorama sitting at 9.1.5, firewalls at 9.1.4.

Cortex Data Lake license is assigned to Panorama and seen in the Panorama -> Licenses section. In order for the firewalls to send the logs to Data Lake, I followed this guide: https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-start... and then https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-start... 

Issue: Cannot assign Logging Service license from the Panorama to managed devices - it is simply not present and refresh does not help, meaning I fail at step 2 from the 2nd link. Cloud service from Panorama perspective is validated and seems to be communicating just fine.

So far I've tried:

• Upgrading Panorama from 9.1.4 to 9.1.5.
• Removing/re-adding Cloud Plugin to Panorama.
• Deleting all licenses from the PA and fetching once more via Panorama.

There could be something obvious, but any ideas?

[reaper]

Did you already do a "license fetch" on the firewalls? That should install the data lake license and enable logging to the cloud

[nikoo]

Yes, but fetching from firewalls shows only licenses assigned via support portal - GP, URL, Threat & Support, nothing more.

Also tried deleting all of them and fetching again, but same result.

Should the logging license show up in the support portal as well as assigned to the firewall just like other licenses?

[ChrisHammock]

@nikoo I am having the exact same problem, did you get an answer?  Is there something that needs to be done in the customer portal?

[nikoo]

Sorry, missed your question. In fact it turned out  there were some other licensing issues, so I didn't pursue this much further, although in theory this should have worked even with that exact setup and licenses. So long story short - can't tell right now what went wrong there.

[ChrisHammock]

Interesting to know if it was the same issue but mine too was unusual.  Basically a registered the devices under my account and then transferred to the customer account.  However I didn't have visibility and later realised despite my emails the customer didn't except the device transfer so it never picked up the logging service licenses.  Its simple if you can see the devices licenses in the customer portal.