topic Re: Management interface connection to sucuri.net in Next-Generation Firewall Discussions

Management interface connection to sucuri.net

adminglu — Tue, 14 Nov 2023 10:16:28 GMT

Hello,

The management interface from our PA-3260 suddenly tries to connect to 192.124.249.36 on port 80 web-browsing. 192.124.249.36 seems to be part of a CDN registered to Sucuri.net. Is this expected behavior, what service is this for?

Re: Management interface connection to sucuri.net

A_Astardzhiev — Tue, 14 Nov 2023 14:20:28 GMT

Hi @adminglu ,

Looking at Reverse IP lookup for 192.124.249.36 - SecurityTrails

it looks like this is a CRL/OCSP URL for GoDaddy.

It is expected firewall to make connections to public CRL and OCSP URLs to validate the status of public certificates. I can think of few reason from top of my head:

- Lots of Palo Alto cloud services are using GoDaddy certificates, like update servers, telemetry servers (for AIOps), Data Lake logging

- Decryption rule (no matter if decrypt or no-decrypt) applying decryption profile, which block connection when server cert is revoked.

- Syslog Server using syslog over TLS.

Re: Management interface connection to sucuri.net

adminglu — Tue, 14 Nov 2023 15:49:27 GMT

Thank you for your response. One thing that might be related is that we recently installed a device certificate from Palo Alto following their recent advisory: https://live.paloaltonetworks.com/t5/customer-advisories/emergency-update-required-pan-os-root-and-default-certificate/ta-p/564672