Palo Alto Networks Certified Network Security Engineer (PCNSE)TroubleshootEasy
A security engineer notices that the Panorama management server is unable to push configurations to a managed firewall. The firewall status in Panorama shows 'Disconnected'. Upon checking the firewall itself, it is online and accessible, and local commits are successful. What is the MOST likely reason for the 'Disconnected' status?
- AThe firewall's management interface cannot reach Panorama's management interface.
- BIncorrect device group or template associated with the firewall on Panorama.
- CThe Panorama management interface is down.
- DThe firewall is not running the compatible PAN-OS version with Panorama.
Show answer & explanationAnswer & explanation
Correct answer: A. The firewall's management interface cannot reach Panorama's management interface.
A 'Disconnected' status indicates a failure in the communication path between the managed firewall and Panorama. If the firewall is online and healthy, the most common reason is a network connectivity issue preventing the firewall's management interface from reaching Panorama's management interface.
Why the other options are wrong
- B. Incorrect device group or template association would cause configuration push failures or unexpected behavior, but it would not typically cause a 'Disconnected' status. The firewall would still be able to communicate with Panorama.
- C. If Panorama's management interface were down, Panorama itself would be inaccessible, not just showing a disconnected firewall.
- D. A PAN-OS version incompatibility might prevent successful pushes or show a 'version mismatch' error, but a 'Disconnected' status primarily points to a communication failure.
Panorama Disconnected Firewall
A 'Disconnected' status for a managed firewall in Panorama typically means the firewall's management interface cannot establish or maintain communication with the Panorama management server.
- Indicates network reachability issues.
- Firewall management plane must reach Panorama.
- Port 3978 is used for communication.
Memory trick: If the phone is off the hook, you can't push messages.