topic Re: PA URL FILTERING UPDATES force to update the HA peer in General Topics

PA URL FILTERING UPDATES force to update the HA peer

SOC_CSG — Mon, 21 Jul 2014 08:44:56 GMT

Hi, i have 2 palo alto 2050 in HA (active/passive). The active HA has intenet acces in order to take the palo lato updates but the passive PA doesnt have access to internet. The problem is that the active PA has a URL version updated but the passive has a version very old. what should i do??? there is any way to send this URL updates from Pa active to passive or i sould give internet access to the passive device???

thanks

Re: PA URL FILTERING UPDATES force to update the HA peer

Wenar — Mon, 21 Jul 2014 09:33:58 GMT

It looks like there is no way at the moment. There was an old discussion about this topicRe: URL Sync to Peer for Active-Passive Cluster.

You should open a feature request with your SE for this.

Re: PA URL FILTERING UPDATES force to update the HA peer

pulukas — Mon, 21 Jul 2014 09:51:49 GMT

There is an option when you setup the dynamic updates to choose "sync to peer" on your primary device. This is designed for the situation you have.

Using this option the download occurs on the primary and is copied and applied to the secondary via HA sync process.

Is Content Database Sync Recommended in an HA Environment?

Re: PA URL FILTERING UPDATES force to update the HA peer

SOC_CSG — Mon, 21 Jul 2014 10:33:39 GMT

i updated the PAN-DB and now they have the same version??????? how can i know if im using brighcloud db or PANDB???? which are the main diferent between these DB? any is better than another?

Re: PA URL FILTERING UPDATES force to update the HA peer

hshah — Mon, 21 Jul 2014 12:30:44 GMT

Hi Cos,

There are multiple ways to determine which DB is used.

1. "Show system Info:

If "url-filtering-version is in "Year-Month-Day" Format than its PAN-DB. Check following output.

admin@65-PA-500> show system info

hostname: 65-PA-500

ip-address: 10.66.18.65

netmask: 255.255.254.0

default-gateway: 10.66.18.1

url-filtering-version: 2014.07.18.810

If not its Brightcloud.

2. Device > License > Check if PANDB is active or Bright cloud.

PANDB is better than Bright cloud, because PAlo Alto Managers PANDB. We have better control and integration with the product. Read following thread for more info.

Re: URL Filtering - PANDB vs. Brightcloud

Regards,

Hardik Shah

Re: PA URL FILTERING UPDATES force to update the HA peer

dyang — Tue, 22 Jul 2014 01:08:09 GMT

Hi Cos,

There is actually slightly different behavior between BrightCloud and PAN-DB when it comes to HA Active/Passive. Given that you are using PAN-DB, I will start with that first.

In an HA Active/Passive scenario with PAN-DB, only the Active device will connect to the PAN-DB cloud. When it does connect to the cloud, it will also update the database version number to indicate that it has synced with the latest version in the cloud. Additionally, the MP cache is backed up every 4 hours, as well as anytime the device is about to restart. Anytime a backup is generated, that is synced to the Passive device. Once this happens, the backup is then loaded into the MP cache of the Passive device, which also updates the Passive device's URL filtering database version number. This is probably what triggered the scenario in which you saw the Passive device get updated (you can verify this by looking at the Monitor-->System Logs). At this point, if the Passive device ever becomes Active, it at least will have a populated MP cache that's at most 4 hours out of sync with the original Active device.

For BrightCloud, the behavior is different in that the MP cache does not get backed up or synced across to the Passive device. Instead, the Passive device to download the latest BrightCloud database when it flips over to Active.

Hope this helps,

Doris

Re: PA URL FILTERING UPDATES force to update the HA peer

LCMember17002 — Mon, 06 Oct 2014 11:27:01 GMT

Thanks for the detailed information. Unfortunately the behaviour on my two PA-500 devices is different.

In an HA Active/Passive scenario with PAN-DB, only the Active device will connect to the PAN-DB cloud. When it does connect to the cloud, it will also update the database version number to indicate that it has synced with the latest version in the cloud.  Additionally, the MP cache is backed up every 4 hours, as well as anytime the device is about to restart.  Anytime a backup is generated, that is synced to the Passive device.  Once this happens, the backup is then loaded into the MP cache of the Passive device, which also updates the Passive device's URL filtering database version number.  This is probably what triggered the scenario in which you saw the Passive device get updated (you can verify this by looking at the Monitor-->System Logs).  At this point, if the Passive device ever becomes Active, it at least will have a populated MP cache that's at most 4 hours out of sync with the original Active device.

The active device backs up its cache every 4 hours and the synced is working. The log on the passive device shows "Received callback from peer for completion of handle url_sync; file /opt/pancfg/opt/pan/content/pan/panurldb.bin.ha." and "Update URL was completed for passive peer.". But the version number on the passive device is not updated. Any idea how I can force this or where I can get more detailed logs?

Re: PA URL FILTERING UPDATES force to update the HA peer

LCMember17002 — Thu, 08 Jan 2015 11:24:02 GMT

The problem still exists. Can somebody help me?

Re: PA URL FILTERING UPDATES force to update the HA peer

oklier — Fri, 09 Jan 2015 22:04:03 GMT

I take it that you have sync to peer checked and have commited the configuration?

I also run active/passive and what I do is use the management interface for all updates. Since the management network has access to the internet, both PAN's will get updates weather they are active or passive.

Re: PA URL FILTERING UPDATES force to update the HA peer

LCMember17002 — Mon, 19 Jan 2015 13:55:38 GMT

Thanks for you reply. To be honest I don't know where I can find the option sync to peer for PAN-DB url updates. I rather think there is no sync-to-peer option for url filtering. Besides that, your screenshots refers to the antivirus update.

Updating the active device is fine. The problem is our passive device. The management interface has access to internet but refering the statement of "dyang" only the active device connects to the PAN-DB cloud. The sync to the passive device fails and this is what I want to solve.

Re: PA URL FILTERING UPDATES force to update the HA peer

oklier — Thu, 22 Jan 2015 23:50:21 GMT

I would say open a support case if the passive device is not getting updated. Sorry we couldnt help more.

Re: PA URL FILTERING UPDATES force to update the HA peer

LCMember17002 — Sat, 31 Jan 2015 09:10:05 GMT

It's ok I'll open a support case.

Re: PA URL FILTERING UPDATES force to update the HA peer

Tobi — Wed, 13 May 2015 08:16:15 GMT

Update to PAN-OS 6.1.3 fixed that problem.