Palo Alto Networks Knowledgebase: Managed Devices Unable to Establish Connections to Panorama after Configuring Permitted IP Addresses

Managed Devices Unable to Establish Connections to Panorama after Configuring Permitted IP Addresses

(1040 Views)
Created On 09/26/18 13:48 PM - Last Updated 09/26/18 14:00 PM
Categories:  Device Management,  Initial Configuration,  Installation,  QoS,  Zone and DoS Protection

Issue:


Solution:


Issue

The Managed firewall devices show not connected to Panorama and are not able to establish a new connection to Panorama.

Panorama-Device-disconnected.PNG

 

 

Cause

The Management Interface on Panorama was configured for Permitted IP Addresses, which does not include devices.  include the IP addresses of the firewall’s interface from where it is configured to connect to Panorama (check the service route config on the firewall), otherwise it will not be able to connect and send logs to Panorama or receive configuration updates.

Secondary+box+-+Mgmt+Access+list.jpg

 

Resolution

To resolve this issue, From the Panorama WebGUI, go to Panorama > Setup > Management > Management Interface Settings > Permitted IP Addresses, and please add the management IP(or network range) of the managed devices to the Permitted IP Addresses list to enable the appropriate management communications between the firewall and Panorama.

Note: Also, please ensure that the same restriction has not been configured on the firewall device to be managed.

 

HA config

If the PA devices are in HA (Active/Passive) and if you disable HA without suspending the HA session then the devices will regularly keep on disconnecting from panorama. Rebooting firewall will get it reconnected to panorama but the issue will reoccur after a few days.

 

Solution: Bring both the devices in HA, you will see both the devices connected panorama. Suspend the HA session on both the ends then disable HA.

 

Troubleshooting

To troubleshoot this issue further, you can perform a Packet Capture on Panorama Management Interface.

It should show SYN packets received from devices on port 3978, but no SYN-ACK is sent from Panorama.

 

Use the following CLI commands to see this:

> tcpdump filter "port 3978"

> view-pcap mgmt-pcap mgmt.pcap

 

See Also

Is there a Separate Connection for Forwarding Logs to Panorama?

Troubleshooting Panorama Connectivity

High Availablity on M-100 Stops Working after Configuring Permitted IP Address Rule on Secondary Device

 

owner: dmaynard

Attachments:

Actions:
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clp2CAC&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Change Language: