Some Palo Alto firewalls in our network can't register to Cortex Data Lake.

[IhnatenkoD]

Hello!

We have about 10 offices, each of them has a firewall, all of them are under Panorama control. Some of these firewalls cannot register in the Cortex Data Lake, if I try to add them manually there, I see the Certificate Status "Needs certificate".

Licenses aren't expired. I tried steps from that doc:

https://live.paloaltonetworks.com/t5/prisma-access-articles/firewall-unable-to-register-to-cortex-da...

and this:

https://live.paloaltonetworks.com/t5/general-topics/connecting-fw-on-pan-os-9-0-1-to-cortex-data-lak...

nothing helps.

[securehops]

Are the firewalls all part of the same CSP account?   

[IhnatenkoD]

I think yes. All firewalls belong to one organization, all of them I can see in one place on Palo Alto portal and all of them are managed from one Panorama.

[IhnatenkoD]

From this solution:

https://live.paloaltonetworks.com/t5/prisma-access-articles/firewall-unable-to-register-to-cortex-da...

When I added command: request logging-service-forwarding certificate fetch

after maybe 30 sec I checked the job (show jobs all) and this job was failed:

[securehops]

Based on your previous comments, you tried some good troubleshooting. 

From Panorama, go to Panorama tab, device deployment, licensing , click refresh.  select one of the bad firewalls and click refresh

You can also try to restart the management server using command

debug software restart process management-server

What version of pan-os?

[IhnatenkoD]

I have a 10.0.6 version of PAN-OS on Panorama and on one of the bad firewalls (on another bad firewalls I have 9.1.3h ver.). And I have refreshed licenses from Panorama as you advised, unfortunatelly it didn't help.

About restarting the management server: you talk about Panorama or firewall?

[IhnatenkoD]

I repeated all steps and use command "debug software restart process management-server" in the end and it didn't help.

[securehops]

I would suggest opening a ticket with Cortex team, they will be able to help