Error:
An unexpected error occurred. Please click Reload to try again.
Error:
An unexpected error occurred. Please click Reload to try again.
托管防火墙显示已断开连接Panorama即使网络连接良好。 - Knowledge Base - Palo Alto Networks

托管防火墙显示已断开连接Panorama即使网络连接良好。

152106
Created On 06/20/22 07:17 AM - Last Modified 10/24/23 17:39 PM


Symptom


  • 托管防火墙与Panorama这是在PAN-OS10.1.
    • > show panorama-status
  • 防火墙之间的 Ping 和Panorama在工作中。
  • 防火墙上的 Netstat 输出显示连接已建立到Panorama在端口 3978 上。
    • > show netstat all yes numeric-hosts yes numeric-ports yes
      
      Example:
      admin@hio-awsgwlbine1e2pafwA-1> show netstat all yes numeric-hosts yes numeric-ports yes | match 172.31.17.171
      tcp        0      0 10.59.142.180:56872     172.31.17.171:3978      ESTABLISHED
      tcp        0      0 10.59.142.180:33018     172.31.17.171:3978      ESTABLISHED
  • ms.log 上的Firewall显示以下错误:-
    • > less mp-log ms.log
       -0700 cmsa: agent index=0
       -0700 Warning:  sc3_get_current_sc3(sc3_utils.c:179): SC3: failed to get SNI
       -0700 Warning:  sc3_get_current_sc3(sc3_utils.c:182): SC3: failed to get CCN
       -0700 [Secure conn] Secure channel for Firewall to panorama communication not enabled for secure conn.
       -0700 Warning:  pan_cmsa_mgmt_assign_ssl_ctx(src_panos/cms_agent.c:2348): client using default (legacy) context
       -0700 Warning:  sc3_get_current_sc3(sc3_utils.c:179): SC3: failed to get SNI
       -0700 Warning:  sc3_get_current_sc3(sc3_utils.c:182): SC3: failed to get CCN
       -0700 COMM: connection established. sock=27 remote ip=XXXX port=3978 local port=60392
       -0700 cms agent: Pre. send buffer limit=46080. s=27
       -0700 cms agent: Post. send buffer limit=2097152. s=27
       -0700 Error:  cs_load_certs_ex(cs_common.c:655): keyfile not exists
       -0700 Error:  pan_cmsa_tcp_channel_setup(src_panos/cms_agent.c:883): cms agent: cs_load_certs_ex failed
       -0700 cmsa: client will use default context
       -0700 Error:  sc3_ca_exists(sc3_certs.c:221): SC3: Failed to get the current CA name.
       -0700 Warning:  sc3_init_sc3(sc3_utils.c:351): SC3: Failed to get the Current CC name
       -0700 SC3: CA: '', CC/CSR: 'XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXX'
       -0700 Warning:  sc3_get_current_sc3(sc3_utils.c:179): SC3: failed to get SNI
       -0700 Warning:  sc3_get_current_sc3(sc3_utils.c:182): SC3: failed to get CCN
       -0700 Warning:  sc3_init_sctx(sc3_ctx.c:323): SC3: not set, skip cert loading
       -0700 SC3A: using SNI (from AK): XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXX
       -0700 SC3A: using sc3 ctx with no cert
       -0700 Warning:  sc3_get_current_sc3(sc3_utils.c:179): SC3: failed to get SNI
      ......
      

       


Environment


  • 管理的防火墙 Panorama
  • Panorama 在PAN-OS10.1及以上
  • 管理FirewallPAN-OS10.1
  • 安全入职


Cause




Resolution


 
  1. 检查是否存在有效的身份验证密钥Panorama:
    • Panorama > 设备注册授权密钥
  2. 如果尚不存在有效的,请创建一个新的:
  3. 去除Firewall从受管设备上Panorama并执行本地Panorama犯罪。
    • Panorama > 受管设备 > 摘要
  4. 去除PanoramaIP地址来自Firewall并执行本地Firewall犯罪。
    • 设备 > 设置 >Panorama设置
  5. 添加Firewall再次作为受管设备Panorama并执行本地Panorama犯罪。
  6. 添加PanoramaIP地址在Firewall连同身份验证密钥并执行本地提交。
  7. 可以在以下位置找到身份验证密钥Panorama> 设备注册授权密钥


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wkjSCAQ&lang=zh_CN&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language