About pverar

@xhoms, I tried with the default admin account, had to change the password since I could not generate a key while using the password which was currently set, some characters seem to cause the issue. When I used a simple password I could generate the key and test the curl, same result with the standard admin account as before. (FYI, running version 8.0.6-h3)   I will open a support ticket for that, I keep you posted! Thanks for your time! ... View more

@xhoms, it is becoming more clear now! I get following error -> <response status = 'error' code = '403'><result><msg>Invalid credentials.</msg></result></response> Although with those credentials I could launch the curl to receive a key without any problem (have to add -k to the curl command due to the cert)... When I try to login with the same credentials in the Panorama webui this is working fine as well, the user has Superuser privileges assigned. You have an idea what the reason could be?   ... View more

@xhoms, thanks for the test and feedback, appreciated!! I executed the steps as you described them but the result is not better, still stuck with the same API error 😞 ... View more

Nobody an idea? I took a packet capture on the MineMeld host and there I see the connection to the Panorama server being established, 3-way handshake setup + data exchange. So from this point all looks correct but my dynamic address group is not populated -> cause is the failing API call for me:   Traceback (most recent call last): File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/gevent/greenlet.py", line 327, in run result = self._run(*self.args, **self.kwargs) File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/minemeld/ft/dag.py", line 276, in _run self._init_resync() File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/minemeld/ft/dag.py", line 234, in _init_resync for a, atags in self._get_all_registered_ips(): File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/minemeld/ft/dag.py", line 92, in _get_all_registered_ips cmd_xml=False File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/pan/xapi.py", line 886, in op self.__type_op(cmd, vsys, extra_qs) File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/pan/xapi.py", line 909, in __type_op raise PanXapiError(self.status_detail) PanXapiError: 000702964134 not connected <DevicePusher at 0x7f37ce9c5550> failed with PanXapiError 2018-02-28T13:37:42 (17217)dag._device_pusher_died ERROR: dagPusher-LIST - exception in greenlet for 10.10.10.10, respawning in 60 seconds Traceback (most recent call last): File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/minemeld/ft/dag.py", line 495, in _device_pusher_died g.get() File "/opt/minemeld/engine/0.9.44/local/lib/python2.7/site-packages/gevent/greenlet.py", line 251, in get raise self._exception PanXapiError: 000702964134 not connected ... View more

I should have mentioned as a comment that the IP and serial are modified in my post, you should not focus on that part. The connection with the Panorama server seems correct since I see the web calls in the system log: 'User pantool logged in via Web from 10.10.10.1 using https'   Following actions were taken to set it up: 1. from prototype 'stdlib.dagPusher' a new prototype was created, in the new prototype a tag was added as well 2. from prototype  ' stdlib.dagPusher'  a clone was done to create a new node where I selected the newly created prototype from step 1 + selected an existing input miner which we feed with IP's we want to block 3. The newly dagPusher node created in step 2 was updated in the handled devices tab, the Panorama server has been added here 4. In the node view connection graph I can see that the newly created dagPusher node from step 2 has received the indicators so all looks correct so far 5. In Panorama a new tag was created corresponding to the tag added to the prototype in step 1 6. In Panorama a new shared dynamic address group has been created with match criteria the tag created in step 5 7. This newly created shared dynamic address group is used in a device group policy which is pushed to a specific VSYS.   Thanks to let me know if I missed a step and if you would have any idea why the API call is failing... ... View more