托管防火墙显示已断开连接Panorama即使网络连接良好。
103785
Created On 06/20/22 07:17 AM - Last Modified 10/24/23 17:39 PM
Symptom
- 托管防火墙与Panorama这是在PAN-OS10.1.
> show panorama-status
- 防火墙之间的 Ping 和Panorama在工作中。
- 防火墙上的 Netstat 输出显示连接已建立到Panorama在端口 3978 上。
> show netstat all yes numeric-hosts yes numeric-ports yes Example: admin@hio-awsgwlbine1e2pafwA-1> show netstat all yes numeric-hosts yes numeric-ports yes | match 172.31.17.171 tcp 0 0 10.59.142.180:56872 172.31.17.171:3978 ESTABLISHED tcp 0 0 10.59.142.180:33018 172.31.17.171:3978 ESTABLISHED
- ms.log 上的Firewall显示以下错误：-
> less mp-log ms.log -0700 cmsa: agent index=0 -0700 Warning: sc3_get_current_sc3(sc3_utils.c:179): SC3: failed to get SNI -0700 Warning: sc3_get_current_sc3(sc3_utils.c:182): SC3: failed to get CCN -0700 [Secure conn] Secure channel for Firewall to panorama communication not enabled for secure conn. -0700 Warning: pan_cmsa_mgmt_assign_ssl_ctx(src_panos/cms_agent.c:2348): client using default (legacy) context -0700 Warning: sc3_get_current_sc3(sc3_utils.c:179): SC3: failed to get SNI -0700 Warning: sc3_get_current_sc3(sc3_utils.c:182): SC3: failed to get CCN -0700 COMM: connection established. sock=27 remote ip=XXXX port=3978 local port=60392 -0700 cms agent: Pre. send buffer limit=46080. s=27 -0700 cms agent: Post. send buffer limit=2097152. s=27 -0700 Error: cs_load_certs_ex(cs_common.c:655): keyfile not exists -0700 Error: pan_cmsa_tcp_channel_setup(src_panos/cms_agent.c:883): cms agent: cs_load_certs_ex failed -0700 cmsa: client will use default context -0700 Error: sc3_ca_exists(sc3_certs.c:221): SC3: Failed to get the current CA name. -0700 Warning: sc3_init_sc3(sc3_utils.c:351): SC3: Failed to get the Current CC name -0700 SC3: CA: '', CC/CSR: 'XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXX' -0700 Warning: sc3_get_current_sc3(sc3_utils.c:179): SC3: failed to get SNI -0700 Warning: sc3_get_current_sc3(sc3_utils.c:182): SC3: failed to get CCN -0700 Warning: sc3_init_sctx(sc3_ctx.c:323): SC3: not set, skip cert loading -0700 SC3A: using SNI (from AK): XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXX -0700 SC3A: using sc3 ctx with no cert -0700 Warning: sc3_get_current_sc3(sc3_utils.c:179): SC3: failed to get SNI ......
Environment
- 管理的防火墙 Panorama
- Panorama 在PAN-OS10.1及以上
- 管理FirewallPAN-OS10.1
- 安全入职
Cause
- 为了加强您的安全态势，PAN-OS 10.1 引入了新设备和新设备之间改进的相互身份验证Panorama在第一次连接时。
- 用于安全入职的身份验证密钥已介绍。
Resolution
- 检查是否存在有效的身份验证密钥Panorama:
- Panorama > 设备注册授权密钥
- 如果尚不存在有效的，请创建一个新的：
- 去除Firewall从受管设备上Panorama并执行本地Panorama犯罪。
- Panorama > 受管设备 > 摘要
- 去除PanoramaIP地址来自Firewall并执行本地Firewall犯罪。
- 设备 > 设置 >Panorama设置
- 添加Firewall再次作为受管设备Panorama并执行本地Panorama犯罪。
- 添加PanoramaIP地址在Firewall连同身份验证密钥并执行本地提交。
- 可以在以下位置找到身份验证密钥Panorama> 设备注册授权密钥