In Palo Alto PAN Integration, Service Composer status is "Alarms are observed for Service Composer"

Products

• VMware vDefend Firewall

Issue/Introduction

• In Palo Alto PAN Integration, service composer status is "Alarms are observed for Service Composer." with a "View All" link - but when you click on the link, nothing happens.
• In the NSX Manager logs, you see entries similar to:
  
  2017-04-03 17:19:29.131 GMT WARN TaskFrameworkExecutor-12 RestTemplate:559 - PUT request for "https://10.16.208.200/api/?client=wget&file-name=dummy&type=vmware/vmware/2.0/si/serviceprofile/serviceprofile-1/containerset" resulted in 502 (Bad Gateway); invoking error handler
2017-04-03 17:19:29.132 GMT ERROR TaskFrameworkExecutor-12 SIRestClient:540 - 502 Bad Gateway
org.springframework.web.client.HttpServerErrorException: 502 Bad Gateway
at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:91)
at org.springframework.web.client.RestTemplate.handleResponseError(RestTemplate.java:566)
at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:524)
at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:482)
at org.springframework.web.client.RestTemplate.put(RestTemplate.java:376)
at com.vmware.vshield.vsm.utils.RestClient.put(RestClient.java:290)
at com.vmware.vshield.vsm.si.restinvoker.SIRestClient.put(SIRestClient.java:538)
at com.vmware.vshield.vsm.si.restinvoker.SIRestClient.updateContainerForProfiles_aroundBody0(SIRestClient.java:245)
at com.vmware.vshield.vsm.si.restinvoker.SIRestClient$AjcClosure1.run(SIRestClient.java:1)
at org.springframework.transaction.aspectj.AbstractTransactionAspect.ajc$around$org_springframework_transaction_aspectj_AbstractTransactionAspect$1$2a73e96cproceed(AbstractTransactionAspect.aj:59)
at org.springframework.transaction.aspectj.AbstractTransactionAspect$AbstractTransactionAspect$1.proceedWithInvocation(AbstractTransactionAspect.aj:65)
at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:260)
at org.springframework.transaction.aspectj.AbstractTransactionAspect.ajc$around$org_springframework_transaction_aspectj_AbstractTransactionAspect$1$2a73e96c(AbstractTransactionAspect.aj:63)
at com.vmware.vshield.vsm.si.restinvoker.SIRestClient.updateContainerForProfiles(SIRestClient.java:237)
at com.vmware.vshield.vsm.si.service.impl.tasks.SITaskManager$SIContainerUpdateTask.run(SITaskManager.java:118)
at com.vmware.vshield.vsm.task.service.Worker.runtask(Worker.java:184)
at com.vmware.vshield.vsm.task.service.Worker.executeAsync(Worker.java:122)
at com.vmware.vshield.vsm.task.service.Worker.run(Worker.java:99)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
2017-04-03 17:19:29.133 GMT ERROR TaskFrameworkExecutor-12 SIRestClient:248 - Error during rest callback. Gobbling up exception:502 Bad Gateway
com.vmware.vshield.vsm.si.exception.ServiceInsertionException: core-services:1803:Error during REST callback : PUT to the registered ServiceManager at : https://10.16.208.200/api/?client=wget&file-name=dummy&type=vmware/vmware/2.0/si/serviceprofile/serviceprofile-1/containerset caused by : 502 Bad Gateway.
at com.vmware.vshield.vsm.si.restinvoker.SIRestClient.put(SIRestClient.java:541)
at com.vmware.vshield.vsm.si.restinvoker.SIRestClient.updateContainerForProfiles_aroundBody0(SIRestClient.java:245)
at com.vmware.vshield.vsm.si.restinvoker.SIRestClient$AjcClosure1.run(SIRestClient.java:1)
at org.springframework.transaction.aspectj.AbstractTransactionAspect.ajc$around$org_springframework_transaction_aspectj_AbstractTransactionAspect$1$2a73e96cproceed(AbstractTransactionAspect.aj:59)
at org.springframework.transaction.aspectj.AbstractTransactionAspect$AbstractTransactionAspect$1.proceedWithInvocation(AbstractTransactionAspect.aj:65)
at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:260)
at org.springframework.transaction.aspectj.AbstractTransactionAspect.ajc$around$org_springframework_transaction_aspectj_AbstractTransactionAspect$1$2a73e96c(AbstractTransactionAspect.aj:63)
at com.vmware.vshield.vsm.si.restinvoker.SIRestClient.updateContainerForProfiles(SIRestClient.java:237)
at com.vmware.vshield.vsm.si.service.impl.tasks.SITaskManager$SIContainerUpdateTask.run(SITaskManager.java:118)
at com.vmware.vshield.vsm.task.service.Worker.runtask(Worker.java:184)
at com.vmware.vshield.vsm.task.service.Worker.executeAsync(Worker.java:122)
at com.vmware.vshield.vsm.task.service.Worker.run(Worker.java:99)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
  
  Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Environment

VMware NSX Data Center for vSphere 6.x

Resolution

To resolve this issue, do a "Synchronize Firewall Config" operation from NSX Manager and "Synchronize Dynamic Objects" operation from Panorama.