topic Re: System Alert:Failure to check wildfire content upgrade in General Topics

System Alert:Failure to check wildfire content upgrade

awarsame — Fri, 28 Jun 2013 12:04:25 GMT

In last two days, I started getting system alerts that says "SYSTEM ALERT : high : Failed to check WildFire content upgrade info due to generic communication error" and another that says "SYSTEM ALERT : high : HA Group 1: Anti-Virus version does not match" from PA-3020 HA pairs. the HA alerts comes always at 1:31am. The system's health seems ok and auto updating regularly from PA.

I am new to PA firewalls so I would appreciate any body can tell me what may be the issue.

thank you

Re: System Alert:Failure to check wildfire content upgrade

ExclusiveNetworksGermany — Fri, 28 Jun 2013 13:20:43 GMT

I would guess that you have configured an automatic update Scheduler for 1:30 am (or may be a little bit earlier)

Depending on your configuration the Master is updated first and then the Update is pushed to the slave

So depending on how long it would take to commit the AV Update there may be a small time frame

where you have a mismatch in AV Versions.

Cheers

Marco

Re: System Alert:Failure to check wildfire content upgrade

kprakash — Fri, 28 Jun 2013 13:22:14 GMT

Hi awarsame,

From what I understand, the PANFW cannot connect to the wildfire server, and thats why we get the "Failed to check WildFire content upgrade info due to generic communication error". Can you change the update server to "staticupdates.paloaltonetworks.com" to see if it makes a difference. ( device tab--> setup--->services )

With regard to the Anti-Virus version does not match issue, verify if the HA pairs havent been configured to download and/or install the version at the same time. The recommended steps is to keep at least a 30 minute time difference, for the download and/or install 30 mins,between both the firewalls. Also verify that the "Enable config Syn" check box is clicked under the HA settings ( device----> high-availability-----> general)

You can also use the command:

request high-availability sync-to-remote running-config

BR,

Karthik

Re: System Alert:Failure to check wildfire content upgrade

mschuricht — Fri, 28 Jun 2013 16:00:22 GMT

I have seen these errors in the past when there are DNS resolution issues.

Is the DNS server that is in Device > Setup > Services working correctly?

Can you ping a FQDN and have the DNS resolve an IP?

Re: System Alert:Failure to check wildfire content upgrade

awarsame — Sun, 30 Jun 2013 12:30:07 GMT

It can resolve FQDN for UPDATES.PALOALTONETWORKS.COM (199.167.52.13) and STATICUPDATES.PALOALTONETWORKS.COM (199.167.52.15).

I tried both of these update servers and I am still getting the wildfire upgrade failure errors. it is not all the time. it succeeds after multiple tries.

Re: System Alert:Failure to check wildfire content upgrade

mschuricht — Mon, 01 Jul 2013 16:21:37 GMT

Please open a case with support for further investigation.