Troubleshooting
Connector status
| Symptom | Likely cause / fix |
|---|---|
| Connector shows red (disconnected) in Connect | The Connector process isn't running, or it can't reach FireMon Connect — check Network Requirements and run firemon-connector --check-connectivity. |
| Pairing fails ("Failed to register") | The registration code expired (24-hour TTL) or was mistyped. Generate a fresh one from Settings > Connectors. |
| Jobs stall, restart from scratch, or a discovery never completes | More than one Connector process is running under the same Connector ID — commonly after a self-update handed your terminal prompt back while the Connector kept running in the background. Stop every copy and start one. See Installation — run one Connector per identity. |
All checks pass in --check-connectivity, but pairing still fails | Double-check the registration code was copied in full and hasn't expired. |
Connectivity
| Symptom | Likely cause |
|---|---|
| All hostnames fail DNS | Resolver unreachable, or *.firemon.cloud isn't allowed through |
| DNS resolves, but 443 fails for every host | Egress firewall blocks all outbound 443 |
| API works, WebSocket fails | Firewall allows the API hostname but not WebSocket Secure (WSS) |
| Registration succeeds, but runtime errors appear afterward | NTP failure → clock drift → TLS certificate failures |
See Network Requirements for the full destination list and the built-in connectivity check.
Panorama (Group Export)
| Symptom | Likely cause / fix |
|---|---|
| Job errors with a TLS/certificate failure | Your Panorama uses a self-signed certificate and Allow Self-Signed Certificate is off. Turn it on under Settings > Accounts > (your account) > Provision. |
| Job errors with an authentication failure | Wrong Panorama username/password — re-enter under Provision. |
| Job errors: device group not found | The Device Group name doesn't exactly match Panorama (case-sensitive) — fix under Provision. |
| Job completes, but nothing changes in Panorama | The Group's Export To isn't set, or it targets a different account than expected. |
| DAG exists but has no members | The Group's filters match no inventory items. Reopen the Group and check the candidate-members preview under Group Candidates. |
| DAG exists in Panorama but not on the firewall | Share Unused Address and Service Objects with Devices is disabled and no enabled policy references the DAG — see Panorama — Verify it landed. |
| No connected firewalls | Export skips accounts whose device group has no connected firewalls — pick a different device group. |
VMware NSX (Group Export)
| Symptom | Likely cause / fix |
|---|---|
| Job errors with a TLS/certificate failure | Your NSX Manager uses a self-signed certificate (the default) and Allow Self-Signed Certificate is off. Turn it on under Settings > Accounts > (your account) > Provision. |
| Job errors with an authentication failure | Wrong username/password, or the account doesn't have permission to create/update Groups. Re-enter credentials under Provision. |
| Job errors immediately after saving the account | Manager Type may not match your NSX deployment — Local Manager vs. Global Manager (Federation) point at different API roots. Confirm which one your NSX Manager is and correct it under Provision. |
| Group appears in NSX but membership looks out of date | Allow a short delay — NSX accepts the update immediately but realizes it asynchronously. Recheck after a minute. |
| Deleted the Group in Connect, but it still exists in NSX | Expected — Connect never deletes objects in NSX to avoid disrupting live enforcement. Remove it manually in NSX Manager (Inventory > Groups) if it's no longer needed. |
Infoblox (Inventory Discovery)
| Symptom | Likely cause / fix |
|---|---|
| Discovery job errors with a TLS failure | Your grid uses a self-signed certificate and Allow Self-Signed Certificate is off — turn it on under Provision. |
| No inventory items appear | Discovery covers the grid's default network view — confirm at least one network exists there in the Grid Manager UI. |
Where the Connector logs are
Local, on the machine or appliance running the Connector:
| OS | Path |
|---|---|
| Linux | /var/log/firemon-connector/ |
| macOS | ~/Library/Logs/firemon-connector/ |
| Windows | %LocalAppData%\firemon-connector\logs\ |
Logs are structured JSON, and the terminal running the Connector prints the key lines as they happen. If you need help from FireMon Support, include the relevant log entries — credentials are never written to them.