Error getting list of services: Prisma access edition license capabilities not present Failed plugin validation - Prisma Access
19812
Created On 07/23/21 02:14 AM - Last Modified 10/13/22 07:03 AM
Symptom
Panorama is managing the Prisma Access environment and it is in production. The plugin starts showing a validation failure error and does not allow the admin to commit on Prisma Access.
Error getting list of services: Prisma access edition license capabilities not present Failed plugin validation
Environment
Prisma Access 2.0 or above managed by Panorama.
Cause
This is usually caused a new license addition/removal or license renewal or when the expired licenses are still present on the system.
Resolution
Follow these steps to fix the issue.
1: Login to Panorama CLI //Enable session logging to save the output.
>request license info. // To view the current licenses >delete license key. // Press Tab to view available and installed license keys. # Now delete any old expire licenses with respect to the Prisma, logging service or support services. >delete license key xxxx.key >request plugins cloud_services panorama-certificate delete. // This deletes the panorama certificate used to communicate to the prisma API >request license fetch. // Verify the licenses >request plugins cloud_services panorama-certificate fetch otp <OTP_KEY_FROM_SUPPORT_PORTAL>
Note:- These steps does not delete any configuration or change anything on the Prisma Access backend.
Following commands can further verify the connectivity.
>request license info >debug plugins cloud_services prisma-access echo-test >request plugins cloud_services logging-service status
2: If the panorama is in HA and the problem is applicable only to the secondary-passive panorama while the primary works just fine, Continue with some additional steps.
3 : Restart the secondary panorama management services. This may take upto 5 minutes for the management services to come back.
debug software restart process management-server
4: Delete the panorama certificate.
request plugins cloud_services panorama-certificate delete
5: Continue with the OTP verification again which will download the certificate again and verify the licenses.
Note-: Please log all of the steps done above during the CLI session and reach out to Palo Alto support teams if the steps do not fix the issue with the session data and Panorama Tech support file.
Additional Information
If these command do not fix the issue, please contact Palo Alto Support team with the Panorama tech support report and output of these commands.