topic Firewallupdates via Panorama - huge delay in download and install in General Topics

Firewallupdates via Panorama - huge delay in download and install

Netzer — Wed, 07 Jun 2023 05:03:35 GMT

Hello,

I'm managing several PA firewalls (10.2.2, 10.2.3, 10.2.4-h2) via Panorama (10.2.4-h2), I noticed a delay in AV, Content and App update deployment, sometimes it's days or even weeks.

For example, the App update is planned to check and install every 30 mins.

Release time is 3:30 in the morning, now it's 6:40 am here and the download still did not start. The other upates show a similar behaviour.

Sometimes there is a delay of days or weeks.

I notice that clicking on the refresh button in the lower left corner seems to trigger the download shortly after clicking it.

But even if the download is done, installation starts rarely with the next 30 min run, so most of the time I need to trigger it manually several times a day. Kinda ridiculous...

Any suggestions?

thx

Daniel

Re: Firewallupdates via Panorama - huge delay in download and install

SimonT — Wed, 07 Jun 2023 05:37:14 GMT

There are a few ways you can do this. 1) Under Panorama > device deployment > dynamic updates > schedule. 2) in a Panorama template setting under Device > Dynamic Updates.

As I recall for new build firewalls you need to log in to both HA members and run "check now" just once. Also if using the template be mindful that the local firewall takes precedence. Log into both HA members and under the dynamic updates section ensure the template settings take precedent with green cog for each entry. You have to click open each db applet to confirm.

If the schedule is not working perhaps there is communication issue?

Re: Firewallupdates via Panorama - huge delay in download and install

Netzer — Wed, 07 Jun 2023 06:24:06 GMT

I already checked the firewalls, all settings are as configured in the Panorama template and the firewalls show the green gear icons in their dynamic update sections.

As the Panorama not reliably downloads the newest updates, I think I have to start from here. However, I rarely see an error in the system log regarding connectivity to PA's update server.