Reason: TCP channel setup failed, reverting configuration issue.

[zGomez]

Hello,

Since recently we have a few firewalls that we are unable to push because the firewall is checking connectivity to panorama and this is failing. 

Inside panorama the device is listed as connected and from the firewall's session table I can see there is an existing session to panorama.

2023-06-07 16:38:38.410 +0200 ACR: Performing panorama connectivity check (attempt 5 of 5)
2023-06-07 16:38:38.410 +0200 [Secure conn] Secure channel for Firewall to panorama communication not enabled for secure conn.
2023-06-07 16:38:56.329 +0200 client dagger reported op command was SUCCESSFUL
2023-06-07 16:38:57.459 +0200 client dagger reported op command was SUCCESSFUL
2023-06-07 16:38:58.807 +0200 Error: pan_comm_get_iplist(cs_conn.c:4711): connmgr: panorama: addr info address: panorama.domain.net error: System error
2023-06-07 16:38:58.808 +0200 Error: pan_cmsa_tcp_channel_setup(src_panos/cms_agent.c:1124): ACR: Failed to establish TCP connection
2023-06-07 16:38:58.808 +0200 ACR: Panorama connectivity check failed for panorama.ontex.net. Reason: TCP channel setup failed, reverting configuration
2023-06-07 16:38:58.808 +0200 ACR: Post-commit connectivity check failed, beginning to revert config.

I already tried increasing timers and amount of retries.   I also verified the firewall is able to reach panorama and is connected.

DNS is working.

Session table is showing me 2 active sessions to panorama.

show session all filter destination 10.255.125.50

--------------------------------------------------------------------------------
ID Application State Type Flag Src[Sport]/Zone/Proto (translated IP[Port])
Vsys Dst[Dport]/Zone (translated IP[Port])
--------------------------------------------------------------------------------
6501 panorama ACTIVE FLOW 10.163.66.253[33607]/management/6 (10.163.66.253[33607])
vsys1 10.255.125.50[3978]/VPN (10.255.125.50[3978])
7007 panorama ACTIVE FLOW 10.163.66.252[45224]/management/6 (10.163.66.252[45224])
vsys1 10.255.125.50[3978]/VPN (10.255.125.50[3978])

anybody else experiencing this?    can i use global counter for management traffic?

Only one of the firewalls in the cluster is having this issue, only active one.  Restarting mangement plane did not help.

[Raido_Rattameister · Accepted solution]

If you change Panorama from DNS name to IP it still fails?

[Jeroen_Proost]

@zGomez Have you found a solution yet ?
I have a similar problem, but unfortunately no solution yet.

[zGomez]

Hi Jeroen,

For met the issue was resolved by checking the primary and secondary dns used under setup, services.  The primary dns in use here was an old dns that was no longer responding.  when issuing a dns lookup from the cli of palo alto i always had a response from the mgt interface.  So i am guessing the panorama check never switches to the seconcary if first is not responding.

Dns resolving was something i checked right away fromt he cli but since this was responding i did not immediatly check the services dns config.

I tried first as Raido suggest the ip and then it worked so this made me look at dns settings.

[bwsaloum]

I started having this same issue while attempting to add a second vpn tunnel to a 220.  The moment I start seeing that message in the firewall system logs, it appears to drop offline in Panorama.  Weird thing is that I can still https and ssh to it...  About the only way  I've been able to recover is to restart the management-server and eventually it reconnects.

[ChuckW]

I too, am experiencing this issue and Panorama has always been referenced by IP and not DNS name.

I am trying to enable ECMP on a HA pair PA5260s