Why do all endpoints appear as disconnected in the ESM Console?

Symptom
The Health page of the ESM Console reports that all endpoints are disconnected even when the endpoint can reach the ESM Server.
Possible Causes
  • The ESM Server does not meet the prerequisites.
  • The Endpoint Security Manager Core service stops and must be restarted. This occurs if you wait more than one hour to install the license key after initially installing the ESM Console software.
  • Inbound traffic is not allowed on the port associated with the ESM Server (default is 2125).
Solution
After each step in the following procedure, verify if Traps can connect to the ESM Server by selecting Check In Now. If Traps still can’t connect to the server proceed to each subsequent step until the issue is resolved.
  1. Verify that the server meets the prerequisites.
  2. Verify that the Traps service is running on the endpoint.
    1. Open the Services Manager:
      • Windows XP: From the Start Menu, select Control PanelAdministrative ToolsServices.
      • Windows Vista and later: From the Start Menu, select Control PanelSystem and SecurityAdministrative ToolsServices.
    2. Locate the Traps service (called CyveraService in older versions of Traps) and verify that the service status is Started.
    3. If the service status is Stopped, double-click the service, then select Start. Click Close.
  3. Verify that the Endpoint Security Manager core service is running on the ESM Server.
    1. Open the Services Manager:
      • Windows Server 2008: From the Start Menu, select Control PanelAdministrative ToolsServices.
      • Windows Server 2012: From the Start Menu, select Control PanelSystem and SecurityAdministrative ToolsServices.
    2. Locate the Endpoint Security Manager core service (called CyveraServer in older versions of the Endpoint Security Manager) and verify that the service status is Started (Windows Server 2008) or Running (Windows Server 2012).
    3. If the service status is Stopped or Paused, double-click the service, then select Start. Click Close.
  4. Verify that the port for the ESM Server is open on the Windows Firewall (default is 2125).
    1. To check port access from the endpoint:
      1. Open a command prompt as an administrator.
      2. Enter the following command to telnet to port 2125 on the ESM Server:
        C:\> telnet <esmServerName> 2125
        where <esmServerName> is the hostname or IP address of the ESM Server.
    2. If you are unable to telnet to port 2125, create an inbound rule to open that port:
      1. Open the Windows Firewall advanced settings:
        • Windows Server 2008: From the Start Menu, select Control PanelWindows FirewallAdvanced Settings.
        • Windows Server 2012: From the Start Menu, select Control PanelSystem and SecurityWindows FirewallAdvanced Settings.
      2. Select Inbound Rules.
      3. Create a new rule to allow Traps to communicate with the Endpoint Security Manager on port 2125 by selecting the New Rule wizard and following the guided instructions.
    3. Verify that you can now telnet to port 2125 on the ESM Server from the endpoint.
  5. Temporarily disable Windows Firewall.
    1. Open the Change Action Center settings:
      • Windows Server 2008: From the Start Menu, select Control Panel. Double-click Action Center and select Change Action Center settings.
      • Windows Server 2012: From the Start Menu, select Control PanelSystem and Security. Double-click Action Center and select Change Action Center settings.
    2. Deselect the Network firewall option.
    3. Click OK.
  6. Verify that connectivity is restored between Traps and the ESM Server.
    From the Traps Console, click Check In Now. If the connectivity is established, the connection status appears as Successful. If the problems persists, contact Palo Alto Networks support.

Related Documentation