topic Re: Palo Alto Updates Detected as a Threat in General Topics

Palo Alto Updates Detected as a Threat

DennyChanditya — Wed, 12 Oct 2022 04:09:27 GMT

Hello all,

im using content update app and threat 8628-7631 and antivirus 4233-4746 on this day.

is there any url database update on app and threat 8628-7631 and antivirus 4233-4746?

i have a problem on firewall palo alto, that firewall detected palo alto updates as a threat. the management traffic is traverse the firewall.

i have policy to allow the paloalto updates app. when i check the log it show palo alto updates detected as a threat

i check using command show dns-proxy dns-signature info and shows SSL Connect Error

i take a sample log on updates to wildfire, thereis no threat vault information

After i whitelist the url *.paloaltonetworks.com, im getting Good Result, but sometimes the updates still detected as a threat in traffic log.

second option is, the traffic from management to the palo alto updates i change the security profile to alert only(before it was strict)

Thanks,

Denny

Re: Palo Alto Updates Detected as a Threat

aleksandar.astardzhiev — Wed, 12 Oct 2022 12:20:56 GMT

Hey @DennyChanditya ,

What threat log you see for the above corresponding traffic logs?

Re: Palo Alto Updates Detected as a Threat

OtakarKlier — Wed, 12 Oct 2022 20:38:55 GMT

Hello,

Its best practice to not inspect the palo alto updates with any service including ssl decryption.

Regards,

Re: Palo Alto Updates Detected as a Threat

DennyChanditya — Thu, 13 Oct 2022 02:59:22 GMT

after some troubleshooting, there is no log on threat log, i see on url filtering that show category not-resolved that the action is block.

first i see the connection from firewall management to palo alto cloud is disconnect. so firewall cant identify the app traffic from internal to extenal since the connection is broke. so the firewall make all the traffic into category not-resolved with the block action, the internal traffic is getting block to external.

i have whitelist *.paloaltonetworks.com in url category , then make policy with alert security profile/remote this security profile from the policy than it will works.

still dont know why the connection from firewall to palo alto cloud is broke, but i assume that theres was a issue with the dns.

Re: Palo Alto Updates Detected as a Threat

DennyChanditya — Thu, 13 Oct 2022 03:08:49 GMT

Thanks otakar, i didn't about this best practice.

for some reason our users dont want a policy that dont have any security profile, but in this case i attach the security profile but with alert only. we dont use the ssl decryption on the firewall.