The Managed firewall devices show not connected to Panorama and are not able to establish a new connection to Panorama.
The Management Interface on Panorama was configured for Permitted IP Addresses, which does not include devices. include the IP addresses of the firewall’s interface from where it is configured to connect to Panorama (check the service route config on the firewall), otherwise it will not be able to connect and send logs to Panorama or receive configuration updates.
To resolve this issue, From the Panorama WebGUI, go to Panorama > Setup > Management > Management Interface Settings > Permitted IP Addresses, and please add the management IP(or network range) of the managed devices to the Permitted IP Addresses list to enable the appropriate management communications between the firewall and Panorama.
Note: Also, please ensure that the same restriction has not been configured on the firewall device to be managed.
If the PA devices are in HA (Active/Passive) and if you disable HA without suspending the HA session then the devices will regularly keep on disconnecting from panorama. Rebooting firewall will get it reconnected to panorama but the issue will reoccur after a few days.
Solution: Bring both the devices in HA, you will see both the devices connected panorama. Suspend the HA session on both the ends then disable HA.
To troubleshoot this issue further, you can perform a Packet Capture on Panorama Management Interface.
It should show SYN packets received from devices on port 3978, but no SYN-ACK is sent from Panorama.