PAN-DB Connectivity

Steven-Chua — Thu, 09 Aug 2018 09:39:22 GMT

Hi,

We are faced with the connectivity issue when we tried to download the URL filtering DB from PAN-DB. As the firewall has an external interface to the internet, we have changed the service route for “Palo Alto Networks Services” to the external interface. However, we are not able to get connected to the PAN-DB.

We are able to ping to the PAN-DB URL. In addition, we are not seeing any traffic logs when we tried to do a download for the URL Filtering DB.

In addition, should we use service route of "URL Updates" or "Palo Alto Network Services" if we are to download / connect to the PAN-DB for the URL filtering?

Thks and Rgds

Re: PAN-DB Connectivity

Lora — Thu, 16 Aug 2018 17:18:21 GMT

We are have our Service Route set to use the management interface. We are on 8.0.x, not sure what version you are on.

What do you see when you issue the show url-cloud status command? Ours looks like this:

show url-cloud status

PAN-DB URL Filtering

License : valid

Current cloud server : s0100.urlcloud.paloaltonetworks.com

Cloud connection : connected

Cloud mode : public

URL database version - device : 20180815.40205

URL database version - cloud : 20180815.40205 ( last update time 2018/08/16 13:07:14 )

URL database status : good

URL protocol version - device : pan/0.0.2

URL protocol version - cloud : pan/0.0.2

Protocol compatibility status : compatible

You could try capturing some packets and doing some log review to troublesoot further (unless you have already done this with TAC). The process goes something like this:

Set up TCPDump PCAP to capture traffic from one CLI window

tcpdump filter "host xx.xx.xx.xx" (xx= ip of the external server hosting PAN-DB)

From a second CLI window; Run a manual PAN-DB refresh via the CLI by "request url-filtering download paloaltonetworks region North-America"

Then export the PCAP file to your workstatoin

scp export mgmt-pcap from mgmt.pcap to user@analyst_workstation_ip:./

Reviewed the PCAP using wireshark looking for possible communication errors (like tls version mismatch for example)

Lastly to view the local logs from the CLI, you can issue a command such as this:

tail follow yes mp-log ms.log from one terminal window while re-issuing the

request url-filtering download paloaltonetworks region North-America command from a second window to see if the error message there will help pin point the issue.

Good luck! Hope this helps. -Lora

topic Re: PAN-DB Connectivity in Advanced Threat Prevention Discussions

PAN-DB Connectivity

Re: PAN-DB Connectivity