SD-WAN: ION2000 issue with getting registered with the portal

[AjitKumar]

I have a brand new ION2000 that is connected to Internet however it does not show up under unclaimed devices on the SD-WAN port.

Can you please help.

Thanks,

Ajit Kumar

NBC Universal

Sr Network Engineer

[PavelK]

Thank you for the post @AjitKumar

ION appliance will register to portal via "controller 1" interface. Could you make sure that this interface is up, has configured DNS and can go to internet (only TCP 443 is enough for registration). Could you run below 2 commands to confirm status?

dump interface config interface=controller1

dump controller status

Kind Regards

Pavel 

[AjitKumar]

Hi Pavel,

Please see requested output below.

Thanks,

Ajit

==

ion toolkit# dump interface config controller
Interface : controller
Description :
ID : 10
Type : port
Admin State : up
Alarms : enabled
NetworkContextID:
Scope :
MTU : 1500
IP : dhcp

ion toolkit# dump controller status
Controller Connection : Partially Connected
Number of Active Connections : 1
--------------------------------------------------------------------------------
tcp 0 0 10.0.0.65:56041 52.8.25.40:443 ESTABLISHED
--------------------------------------------------------------------------------
ion toolkit#

[PavelK]

Thank you for reply @AjitKumar

From the output of: "dump interface config controller" it looks like that ION is connected to portal.

Could you run below debug to to confirm that all test are passed:

debug controller reachability controller1

Kind Regards

Pavel

[AjitKumar]

Hi Paval,

Please see below the output as per your request:

ion toolkit# debug controller reachability controller
TPM-tcsd running fine
cic/mic id not in keys-list
ion toolkit#

Thanks,

Ajit

[PavelK]

Thank you for reply @AjitKumar

Based on debug output you provided, it looks like that the MIC (Manufacturer Installed Certificate) is missing/invalid. During the initial registration, the CloudGenix controller validates the ION's MIC, which is stored in the TPM. This is however failing. This is likely reason why you can't see this ION under unclaimed devices in portal. At this point, I would reach Palo Alto support. I do not believe this is something you can fix by your self.

Kind Regards

Pavel