Network Management

Palo Alto Firewall Not Polling After Moving Polling Engines

This article describes an issue with Palo Alto Firewalls failing to poll new data over API after moving to another polling engine and how to restore polling.

First published date

5/29/2025 5:01 PM

Last published date

10/21/2025 7:45 PM

Overview

Reproduction Steps:
      1) Add Palo Alto Firewall as node to Main Polling Engine with API credentials

      2) Allow a few polling cycles to pass so data is populated (eg global protect vpn)

      3) Move node to Additional Polling Engine

      4) Wait a few polling cycles and notice data is not current


No errors are observed in the Web Console.

Testing API credential passes successfully.

No warning or errors in the Cortex log.





Product section

Network Performance Monitor

Cause

The polling engine is updated for the node, but not for the Cortex Firewall element, which handles the Palo Alto API polling.

[Table: NodesData]
--------------------
NodeID 4391
EngineID 2

[Table: Cortex_Documents]
----------------------------
ElementId 13935672
Data "{
""ModelType"": ""Orion.NetMan.Firewalls.Firewall"",
""Properties"": {
""OrionNodeId"": 4391,
""Status"": 1,
""PollState"": 2,
""EngineId"": 1,
""Id"": 13935672
} 




Resolution

The issue is resolved in SolarWinds Platform 2025.4. Consider upgrading your environment. If you can't upgrade, use the workaround below.

Note: Back up the database prior to the steps below.

Manually update the database using generic query template:


Query to update individual node

11111 - current polling engine
22222 - new polling engine
33333 - palo alto firewall node

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

UPDATE Cortex_Documents SET Data = REPLACE(Data, '"EngineId": 11111', '"EngineId": 22222') WHERE Data LIKE '%"OrionNodeId": 33333%' AND Data LIKE '%Orion.NetMan.Firewalls.Firewall%'


Query to update all Firewall nodes

11111 - current polling engine
22222 - new polling engine

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

UPDATE Cortex_Documents SET Data = REPLACE(Data, '"EngineId": 11111', '"EngineId": 22222') WHERE Data LIKE '%"ModelType": "Orion.NetMan.Firewalls.Firewall"%'


After finishing the query, restart the Cortex service in the current polling engine and the new polling engine.