Service Connection Error on Primary Panorama Configuration not in Sync

[chrissmithgt]

I am getting this error on the service connection and do not see away to sync the configuration. I have tried to commit also commit and push there is nothing to commit. How do you sync the configuration with the cloud service? I have failed over to the HA and nothing changes. Suggestions.

Chris Smith

[Sai_Tumuluri]

@chrissmithgt 

You can check commit error reason using the following document and let me the error reason

https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/Verify-Commit-Failure-Reason-on-Prisma-A...

more references

https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/Prisma-Access-Useful-Resources/ta-p/2824...

[chrissmithgt]

Looks like we might be hitting a bug. These are my primary and secondary panoramas and I am not seeing the prisma information any more. I have run the panorama debug url and cleared preferences and nothing is changing.

[Sai_Tumuluri]

@chrissmithgt  Try logging out and logging in

if it does not fix it, try the steps in the following link to reauthenticate Panorama to Prisma Access

https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/Panorama-Connectivity-Issues-to-Prisma-O...

[chrissmithgt]

Still showing out of sync. 

Shows vaildation error but no information to check 

[Sai_Tumuluri]

Click on "Validation errors" to see commit error

You can check commit error reason using the following document and let me the error reason

https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/Verify-Commit-Failure-Reason-on-Prisma-A...

more references

https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/Prisma-Access-Useful-Resources/ta-p/2824...

[Sai_Tumuluri]

is the issue solved?

[chrissmithgt]

This issue has not been resolved. It still indicates out of sync with no evident way to sync the connection. Shows a vaildation error but no hyper link to give an explination.

[Sai_Tumuluri]

@chrissmithgt 

In general clicking, the "Validation error" should show the error. One of the common reason is ike gateway config. If the following link does not help, I would recommend a TAC Case

https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/IKE-Gateway-Commit-Failure-Peer-Gateway-...

[chrissmithgt]

I have a TAC case open. 

[Sai_Tumuluri]

@chrissmithgt  did we get the root cause from tac case?

[Sai_Tumuluri]

was rca identified ?

[chrissmithgt]

No TAC is still looking into the situation. It is still out of sync with no way to sync. There is no hyper link to click on to indicate what is not working. Hopefully, TAC can sync back up with me to finish troubleshooting this issue. The engineer had to jump off my call on Friday. He had a hard stop at 3pm. So I am waitining on him or someone else to contact me to try somemore troubleshootng efforts.

[UmarKhan]

Was this resolved? IF SO WHAT WAS THE FIX?

[OscarAlvarez]

Hi There,

For future references, here is the information for the issue in question.

Symptom

Panorama > Cloud services > Status shows the service connection config status as  error and in red color.

The message on the error is displayed as "Configuration is not in sync" and a Job ID.

There is no impact observed on the service connection functionality.

 

 

Cause

This error message indicates that the configuration in the service connection template or shared configuration has been changed.

A panorama local commit has been done afterwards. 

A push was done to other components like Mobile users or remote networks but not to the service connection.

This does not necessarily indicate a problem but the denotes that some part of configuration was changed and a push has not been done to the service connection, hence config mismatch. 

The existing configuration sent to the service connection infrastructure continues to work as it is.

This can further be validated by hovering the mouse over the Config status for other services like Mobile users.

The Job ID will be different for the ones showing OK compared to the service connection status which will show older Job ID.

Resolution.

1. Perform a minor or dummy change in the shared configuration like an object change.
2. Perform a local panorama commit & Push to the Prisma Access and select service setup as well in the Prisma Access tab.
3. This selection is to be under Push window > Edit selection > Push Scope selection > Prisms Access.
4. Once a commit is sent to the Prisma Access (including service setup), the status will first change to "Commit in Progress" and then "OK" if the commit is successful.
   Additional Information

   This is expected behaviour and not an error or problem. 

   Even if the change is in Shared config which does not apply to the service connection, Commit & Push should be done to all the nodes to avoid this status change.

   Alternatively, ignore the config status error since this would be expected when changes are made in shared config and push is not done to the service connection.

   Regards,

   Oscar Alvarez | Palo Alto Networks Technical Support