Tufin securetrack is monitoring the device groups from Panorama, in the dashboard you saw the status is device connected, however when you go to Settings > administration > status, the device group is amber and the status is Error:Unable to get configuration.
Usually is because the Palo Alto Firewall is disconnected from Panorama. Login to your Panorama then go to Panorama > Managed device, if you see the status of your device group says disconnect, then go to Panorama > Setup, look for Managed Interface Settings under permitted ip address check to ensure Palo Alto firewall management ip address is inside the permitted ip address.
cyruslab 