topic Re: PA-FW Update getting Fail in General Topics

PA-FW Update getting Fail

ParvezAhmad — Tue, 10 Jun 2014 10:10:22 GMT

Dear Experts,

We have PA-FW getting fail during the Update. Firewall has three zones: Inside,Outside and DMZ.

Management IP address of PA-FW is passing through Inside zone of the PA-FW. Management interface of the FW has the gateway on the core switch and core-switch has the default gateway of the Inside zone interface.

In the traffic logs.. The connections are incomplete.

Please advice how to fix it.

Thank you

Re: PA-FW Update getting Fail

_slv_ — Tue, 10 Jun 2014 14:50:13 GMT

Hello

Despite the root cause of your problem You can use alternative way of upgrading from CLI.

Here You have doc's :

Is it possible to upgrade from the command line while using a console session?

https://live.paloaltonetworks.com/docs/DOC-5170

Because you have PAN OS downloaded so the first doc should be enought.

If now - probably You have to open support ticket.

Regards

Slawek

Re: PA-FW Update getting Fail

HULK — Tue, 10 Jun 2014 15:43:00 GMT

Hello Parvez,

Step-1: Could you please apply CLI command > tail follow yes mp-log ms.log ------ while trying to get updates. It should give you more insight about this failure.

Step-2: You may try to do an "nslookup" for update server.

Step-3: you can check the real time session in the CLI by using 'show session all filter source IP_ADD_OF_THE_MGMT-INTERFACE destination IP_ADD_OF_THE_UPDATE_SERVER' --- collect the session ID from this command

Apply CLI command >show session id xyz. to get detail information i.e NAT rule, C-S and S-C flow( C-Client, S-server) etc.

Hope this helps.

Thanks

Re: PA-FW Update getting Fail

_slv_ — Tue, 10 Jun 2014 19:06:24 GMT

I forget to mention that CLI in thats situation mean CLI by management serial port (RS232)

Re: PA-FW Update getting Fail

ParvezAhmad — Wed, 11 Jun 2014 12:54:36 GMT

Below is the output.

admin@PA-(active)> show session all filter source 10.20.65.1

--------------------------------------------------------------------------------

ID Application State Type Flag Src[Sport]/Zone/Proto (translated IP[Port])

Vsys Dst[Dport]/Zone (translated IP[Port])

--------------------------------------------------------------------------------

116506 undecided ACTIVE FLOW NS 10.20.65.1[36490]/Inside/6 (80.50.158.252[62521])

vsys1 199.167.52.13[443]/Internet (199.167.52.13[443])

admin@PA-(active)> show session id 116506

Session 116506

c2s flow:

source: 10.20.65.1 [Inside]

dst: 199.167.52.13

proto: 6

sport: 36490 dport: 443

state: INIT type: FLOW

src user: e-j\i

dst user: unknown

s2c flow:

source: 199.167.52.13 [Internet]

dst: 80.50.158.252

proto: 6

sport: 443 dport: 62521

state: INIT type: FLOW

src user: unknown

dst user: e-j\i

start time : Wed Jun 11 14:17:58 2014

timeout : 10 sec

total byte count(c2s) : 222

total byte count(s2c) : 390

layer7 packet count(c2s) : 3

layer7 packet count(s2c) : 5

vsys : vsys1

application : incomplete

rule : For PA-Updates

session to be logged at end : True

session in session ager : False

session synced from HA peer : False

address/port translation : source + destination

nat-rule : TMG-NAT(vsys1)

layer7 processing : enabled

URL filtering enabled : False

session via syn-cookies : False

session terminated on host : False

session traverses tunnel : False

captive portal session : False

ingress interface : ethernet1/2

egress interface : ethernet1/1

session QoS rule : N/A (class 4)

tracker stage firewall : Aged out

admin@PA-(active)>

Re: PA-FW Update getting Fail

pulukas — Sun, 22 Jun 2014 14:29:20 GMT

Search the logs for the update errors on this list.

Updater Error Codes

Once you identify the error, search that error in the document section here for the remediation steps.