Troubleshooting Firewall's connection to IoT Security Edge Service
7594
Created On 08/24/22 02:17 AM - Last Modified 09/18/25 09:18 AM
Objective
To resolve the connectivity issue of the firewall to IoT's service edge
Environment
Palo Alto Networks Firewalls
IoT
Procedure
- Verify that the NGFW has the needed IoT license
> request license info
License entry:
Feature: Enterprise IoT Security
Description: Enterprise IoT Security
Serial: 0123456789
Authcode: 1234567
Issued: April 18, 2024
Expires: April 18, 2025
Expired?: no
- Verify that no proxy is between the FW and IoT's service-edge
- Check NGFW's DNS settings are properly configured, under Device > Setup > Services > Global > click on edit Icon > DNS Settings
- Verify that NTP is working, use How to troubleshoot NTP server connection failure
- Certificate validity, use HOW TO RENEW OR REPLACE AN EXPIRED CERTIFICATE
- PAN-OS v10.0 and below, verify that both the logging service certificate and device certificate are valid
- PAN-OS v10.1 and above, verify device certificate is valid
- If DP interface is used for the source connection to IoT's service-edge, verify that security policy and NAT with source-IP 127.168.0.0/16 are configured
- Check Policy Rule Recommendations
- Configure the following accordingly, based on the region as provided in step 5
> configure
# set deviceconfig setting iot edge address apac.iot.services-edge.paloaltonetworks.com
# commit force
# exit
> quit
>debug iot clear-all type cookie
>debug iot icd reset cookie