topic Re: download PAN-DB Error in General Topics

download PAN-DB Error

Satish — Thu, 25 Sep 2014 13:01:24 GMT

Dear Friends, I am try to download PAN-DB for URL but i am getting below error. please suggest. PAN-DB list Loading Failed (ERROR: SSL Connect Error)

Re: download PAN-DB Error

Satish — Thu, 25 Sep 2014 13:02:57 GMT

Re: download PAN-DB Error

${userLoginName} — Thu, 25 Sep 2014 13:05:57 GMT

Try looking at some log files to get a clue to what's going wrong via the CLI:

for example: tail follow yes mp-log ms.log

Kind regards,

Bob

Re: download PAN-DB Error

HULK — Thu, 25 Sep 2014 13:07:15 GMT

Hello Satish,

Do you have an internet connection directly from the management interface or you are using service route.?

Please apply CLY command while trying to download the database, and share the putput.

> tail follow yes mp-log ms.log

Thanks

Re: download PAN-DB Error

Satish — Thu, 25 Sep 2014 15:56:33 GMT

Dear Hulk, No, i am using service route. and device is vwire Mode. i am able to update PAN os, Antivirus... etc but problem is only for URL DB. other Point is that i am also not find any url log in monitor tab. Regards Satish

Re: download PAN-DB Error

ssharma — Thu, 25 Sep 2014 16:24:34 GMT

Hi Satish,

Are you using Management interface or Dataplane interface to get the get the update. This is configured under Device -> Setup -> Services -> Service Route configuration. From system logs it seems issue is with the ssl connection. There can be many variables causing the ssl failures.

If you are using dataplane interface (external interface) to get the update, do you have deny any any rule. Also, could you please change your interfaces under Service Route Configuration for URL Updates. (For ex if you are using default, use external or internal interface) and Commit. Hope this helps.

Re: download PAN-DB Error

Satish — Thu, 25 Sep 2014 16:29:07 GMT

Dear ssharma, I am using Management interface for update. and no any deny rule. Thanks Regard satish

Re: download PAN-DB Error

ssharma — Thu, 25 Sep 2014 16:30:36 GMT

Hi Satish,

Can you change it to inside or trust interface and do a commit. And notice if you still get the same error? Thank you

Re: download PAN-DB Error

HULK — Thu, 25 Sep 2014 16:31:43 GMT

Hello Satish,

Since you have a service route to reach update server through data-plane interface, make sure "Palo Alto Updates" are set to physical interface ( data-plane).

Thanks

Re: download PAN-DB Error

Satish — Thu, 25 Sep 2014 16:35:12 GMT

Hi Ssharma, I am using Vwire mode and Mg port have internet access. Thnks

Re: download PAN-DB Error

HULK — Thu, 25 Sep 2014 16:38:03 GMT

Hello Satish,

It will be better to have the ms.log to understand the point of failutre.

Could you please update CLI output here. > tail follow yes mp-log ms.log

Thanks

Re: download PAN-DB Error

Satish — Thu, 25 Sep 2014 16:39:53 GMT

Hi Hulk bro.., but i am able to update for PAN os same config but only problm in PAN-URL.please clear me ur concept. Thanks

Re: download PAN-DB Error

ssharma — Thu, 25 Sep 2014 16:40:15 GMT

Oh ok....do you have any other firewall or device in the path that might be blocking the traffic. In that case, we will need to sniff the traffic when its leaving the firewall's mgmt ip and see why ssl connection to pandb is not successful (look for fin, rst and see where it is coming from).

Re: download PAN-DB Error

Satish — Thu, 25 Sep 2014 16:40:53 GMT

Hi Hulk Bro. Oky, let me check and what about logs.

Re: download PAN-DB Error

Satish — Thu, 25 Sep 2014 16:49:46 GMT

If I put The PAN firewall After sonicwall i am geting all trafic but when i have put the firewall before Firewall any not geting traffic and i have configure 2 trust zone and 2 untrust zone and rule any any allow and profile alert. plz suggest.

Re: download PAN-DB Error

HULK — Thu, 25 Sep 2014 16:52:15 GMT

Just FYI.

Once you will try to download any update, there will be 2 separate connections established to complete it successfully. 1st, it will try to reach the license server to verify the license information for the device S/N. Upon successful completion, it will try to establish an another SSL connection to a CDN network ( Public IP starts with 192.x.x.x.x) to download the actual database.

So, we need to make sure SSL is allowed throughout the path. Pls verify if any SSL packet with destination prefix (192 or 191 ) is getting dropped at sonicwall.

Thanks

Re: download PAN-DB Error

Satish — Thu, 25 Sep 2014 16:56:45 GMT

Oky Bro.., Let me check and come back to you. Thanks Regards Satish

Re: download PAN-DB Error

jperry1 — Thu, 25 Sep 2014 17:01:31 GMT

Satish

You can sniff the traffic in your management interface by using the following commands

> tchdump <--- let this command run for 10-15 seconds after trying to manually update

> view-pcap mgmt-pcap mgmt.pcap mgmt.pcap <--- it will show you the PCAP output for the management interface

> view-pcap verbose++ yes mgmt-pcap mgmt.pcap <-- will give you more detailed output

It sounds as if something may be blocking that traffic on the sonicwall but we won't know until more detail.

Do you see any log output on the Sonicwall saying it is blocking an item?

Re: download PAN-DB Error

Satish — Thu, 25 Sep 2014 17:06:47 GMT

Dear Jperry, Thanks for your reply. i will do this tomorrow and come back to hare. Thanks Regards Satish

Re: download PAN-DB Error

prb — Thu, 25 Sep 2014 17:52:18 GMT

Something up with SSL connectivity. Logs should give a clue.

Perhaps you can open a support ticket for quicker resolution?