06-07-2023 07:56 AM
Hello,
Since recently we have a few firewalls that we are unable to push because the firewall is checking connectivity to panorama and this is failing.
Inside panorama the device is listed as connected and from the firewall's session table I can see there is an existing session to panorama.
2023-06-07 16:38:38.410 +0200 ACR: Performing panorama connectivity check (attempt 5 of 5)
2023-06-07 16:38:38.410 +0200 [Secure conn] Secure channel for Firewall to panorama communication not enabled for secure conn.
2023-06-07 16:38:56.329 +0200 client dagger reported op command was SUCCESSFUL
2023-06-07 16:38:57.459 +0200 client dagger reported op command was SUCCESSFUL
2023-06-07 16:38:58.807 +0200 Error: pan_comm_get_iplist(cs_conn.c:4711): connmgr: panorama: addr info address: panorama.domain.net error: System error
2023-06-07 16:38:58.808 +0200 Error: pan_cmsa_tcp_channel_setup(src_panos/cms_agent.c:1124): ACR: Failed to establish TCP connection
2023-06-07 16:38:58.808 +0200 ACR: Panorama connectivity check failed for panorama.ontex.net. Reason: TCP channel setup failed, reverting configuration
2023-06-07 16:38:58.808 +0200 ACR: Post-commit connectivity check failed, beginning to revert config.
I already tried increasing timers and amount of retries. I also verified the firewall is able to reach panorama and is connected.
DNS is working.
Session table is showing me 2 active sessions to panorama.
show session all filter destination 10.255.125.50
--------------------------------------------------------------------------------
ID Application State Type Flag Src[Sport]/Zone/Proto (translated IP[Port])
Vsys Dst[Dport]/Zone (translated IP[Port])
--------------------------------------------------------------------------------
6501 panorama ACTIVE FLOW 10.163.66.253[33607]/management/6 (10.163.66.253[33607])
vsys1 10.255.125.50[3978]/VPN (10.255.125.50[3978])
7007 panorama ACTIVE FLOW 10.163.66.252[45224]/management/6 (10.163.66.252[45224])
vsys1 10.255.125.50[3978]/VPN (10.255.125.50[3978])
anybody else experiencing this? can i use global counter for management traffic?
Only one of the firewalls in the cluster is having this issue, only active one. Restarting mangement plane did not help.
