topic Re: Check software update failed in General Topics

Check software update failed

DKanta — Tue, 24 Jan 2017 09:44:39 GMT

Hi all!

I have this problem: when i check new software updates, clicking "check now" button, this error appears: "Failed to check upgrade info due to generic communication error. Please check network connectivity and try again."

Doing a traceroute we see that after the 17th hops the trace stops, all the ping are unsuccesful

17 * paloaltonetit-5.border3.sje011.pnap.net (66.151.155.74) 163.015 ms *

18 * * *
19 * * *

[...]

30 * * *

DNS resolves name correctly (traceroute to updates.paloaltonetworks.com (199.167.52.141)), and as you can see the packet go on Internet.

Can someone please help me? Anyone saw this problem?

Regards,

Daniele Cantarelli

Re: Check software update failed

TranceforLife — Tue, 24 Jan 2017 14:13:09 GMT

Hi,

How do you get to the updates.paloaltonetworks.com using mgmt interface or outside (Internet facing interface).

Below KB on how to change service route option fro the device to use a different source ip while "talking" to the external recourses

https://live.paloaltonetworks.com/t5/Configuration-Articles/Setting-a-Service-Route-for-Services-to-Use-a-Dataplane/ta-p/59433

P.S ping and traceroute are disabled on the server, so don't worry

Re: Check software update failed

DKanta — Tue, 24 Jan 2017 10:04:55 GMT

Hi,

This issue started after the last update of PanOS, it could be possible that the update changed some parameters?

Regards,

Daniele Cantarelli

Re: Check software update failed

TranceforLife — Tue, 24 Jan 2017 14:13:41 GMT

Hi,

I don't think so. If it was working fine before please try to use"check now" for few times. l do have these messages from time to time in our lab device.

Thx,

Myky

Re: Check software update failed

DKanta — Wed, 25 Jan 2017 14:01:50 GMT

Hi Myky,

it's several days this error occours, and we continue to click on "check now" but nothing change.

Could it be a bug of PanOS? The version is 7.1.7.

Regards,

Daniele Cantarelli

Re: Check software update failed

TranceforLife — Wed, 25 Jan 2017 14:06:16 GMT

Hi,

Do you get dynamic updates downloaded successfully (e.g AV, WildFire or threat prevention)?

Thx,

Myky

Re: Check software update failed

kdd — Wed, 25 Jan 2017 15:04:19 GMT

do you see "check now" at the log with the external interface and did you configure NAT as well?

not the external interface - then change the service route

no NAT and private IP - then used NAT with Public IP

still not working - please show the log entry and rule

Re: Check software update failed

OtakarKlier — Wed, 25 Jan 2017 17:26:03 GMT

Hello,

If your not blocking any of the update traffic, have you cheked to see if the licenses are still valid? Perhaps perform a refresh on them.

Device->Licenses-> Retrieve licenses from server

Also make sure you are not SSL decrypting that traffic.

Happened to me when we renewed support.

Regards,

Re: Check software update failed

DKanta — Thu, 26 Jan 2017 10:29:13 GMT

hi Myky,

i have the same problem with dynamic updates.

Regards,

Daniele

Re: Check software update failed

TranceforLife — Thu, 26 Jan 2017 10:35:31 GMT

Hi,

Ok as people already mentioned here:

1) check the licenses

2) change the service route to use your external IP to talk to the updates servers

Thx,

Myky

Re: Check software update failed

BPry — Thu, 26 Jan 2017 14:02:05 GMT

@DKanta, to add to this the majority of the time the only thing that you will have to do is retrieve the licenses from the server to get it to function again if it was working previously. I'm not sure why they occasionally drop off but that will usually fix it perfectly fine. If it was working previously there should be no need to change your routing unless you have made other changes to your management port.

Re: Check software update failed

DKanta — Thu, 26 Jan 2017 15:12:07 GMT

Hi @BPry,

i tried to retrieve the license (Device->Licences->Retrieve License keys from License server), but this don't work, after some seconds appear the popup: "Failed to install licenses. Failed to get license info. Please try again later."

It seems that all the Palo Alto servers are unreachable.

Regards,

Daniele

Re: Check software update failed

BPry — Thu, 26 Jan 2017 15:16:18 GMT

@DKanta interesting. That definitely does sound like an actual service route issue; are you seeing the issue after updating to 7.1.7 as well?

Re: Check software update failed

DKanta — Thu, 26 Jan 2017 15:22:27 GMT

Hi @BPry,

yes, because the PA was updated with online method, not downloading the image and uploading on the PA.

So do you suggest me to change the service route configuration?

Regards,

Daniele

Re: Check software update failed

BPry — Thu, 26 Jan 2017 15:27:15 GMT

@DKanta, at that point I would but it would be nice to get TAC involved if this is a wide-spread issue so that they can address and fix it going forward.

Re: Check software update failed

TranceforLife — Thu, 26 Jan 2017 15:27:20 GMT

Sure give a go (l thought you did already). If your DNS is working there is no way that you will get the same errors by using external interface to talk to the update server.

p.s logging to the support website and check the licence status there by checking your serial number withing assets

Re: Check software update failed

DKanta — Fri, 27 Jan 2017 10:31:02 GMT

Hi all!

Changing the Service Route Configuration the issue risolved.

Thanks @TranceforLife and @BPry for the suggestion!

Regards,

Daniele