About rlarose

It's listed in the 10.2.8 release notes as fixed.  Have you let them know? ... View more

It's showing up now as a known issue for 10.2.5: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-release-notes/pan-os-10-2-5-known-and-addressed-issues/pan-os-10-2-5-known-issues PAN-222418 The firewall intermittently records a reconnection message to the authentication server as an error, even if no disconnection occurs. ... View more

Conversation w/ whom -- PAN support folks?  Did they provide any info on what is causing it?  Is it a totally bogus message or is something untoward going on?   I can confirm we are seeing the log messages in 10.2.5. ... View more

Likewise, seeing this on my panorama 10.2.5 ... View more

Hi @EO-AlexJinks    I have been told that the root cause of the issue is resolved in PanOS 10.2 and that fix will not be ported back to earlier 10.x or 9.x PanOS versions.   I was provided with a workaround solution that they should be able to provide for you, too.  If your case is not being addressed, you should ask them to use my PAN Support case number 02496793 for reference. ... View more

@onercan congratulations, that's good news.   I was away last week but did receive a reasonable RCA from Palo, as well as a workaround to restore successful connectivity in PanOS versions prior to 10.2.  Early test of their workaround was successful and I'll be deploying today.   Did y'all also get the email I got from Slack saying that by May 9th all clients will need to have a working X1 Root certificate?  That to me suggests they are going to switch from LE long-chain to LE short-chain after all, which will presumably render this problem moot.  I have not received direct contact from my Slack account or support folks about this, though, so only speculating what the broadcast email means. ... View more

The *impression* I got was that someone over there had tested in on 10.2 and decided it didn't have the same problem.  But I can't swear to that.  The fact that it's a problem at all suggests they have not been thorough with their testing/validating. ... View more

Hi @onercan - no, not at this time.  I've been advised by Palo Support that PanOS 10.2 does not have the issue, but can't verify that as we're on actively-supported v9.1.15.   I saw 9.1.16 dropped this week --the release notes mention expired root cert handing for ssl decryption but not specifically with HTTPS log forwarding process.. ... View more

Welcome to the party @VladimirL  please share any progress you're able to make on your case.   ... View more

Well acknowledging the noise we're making is a good first step.  They need to band-aid it right away, though. ... View more

The feature request they're referring to from the closed case is not related to this problem.  It's about avoiding the infinite loop of system logs trying to send to a dead log server, which fails & raises a system log which it tries to send to the log server, which fails & raises a system log..... etc forever. ... View more

My case has not been closed -- they're referring to the case about 2 weeks prior when slack also jiggled the handle on their cert (maybe a dry-run?) which caused me some trouble.   My open, active, unresovled case number you can reference is 02496793 ... View more

We know it's not inherent to the PanOS version, as I'm runing 9.1 and @scottymuse is running 10.1.   Are your firewalls just not under support at all?  As long as they are, even on the end-of-support OS, you should be able to raise a case and it would help put pressure on Palo to acknowledge and address it.   Also press the issue with Slack -- it's their change that broke things. ... View more

No solution yet @onercan -- can you share your PaloAlto support case number?  It will help lend weight when we can make clear that this is not an individual config problem, but rather a PanOS problem. ... View more