Twistlock Learned Connection Issues

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Twistlock Learned Connection Issues

L0 Member

 I need to gather a list of connections between all pairs of Kubernetes containers over a given time. After attempting to gather this data from the Twistlock, I have some questions.   

 

1. What is the difference between the learned connections shown in the Radar view and in the Firewalls view?  The views can be found in these places: 

    a. Radar >> click on a connection line >> Connection info (source: learned)

    b. Firewalls >> Cloud Native Network Firewall >> Container >> Allowed learned connections >> Show connections

2. Is there any way to gain visibility into the period when Radar/CNNF are (or were) in learning mode for a given container?  

3. Unlike in the Radar view, I cannot see any learned connections in the CNNF view. I receive a “Failed to get learned connections” error. What would be the best way to troubleshoot this error? It does not appear in the Twistlock documentation and does not seem to correlate with any errors in the console logs.

2 REPLIES 2

L0 Member

We are having this same issue. I opened a support case and they were able to determine the issue. We are still working through a resolution.

L0 Member

Hello,

 

There should be no differences between the Radar and Firewalls view. Do you mind elaborating further on this?

 

How do you tell when it's in learning mode? This article explains in detail 

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/firewalls/cnnf

 

As far as failing to get learned connections goes, this could be caused by several reasons. I recommend opening a case with support about that error.

Ryan Hollis  |  Engineer, Customer Success | Prisma CloudPalo Alto Networks
  • 4914 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!