topic Re: Why paloalto-updates application is SSL now? in General Topics

Why paloalto-updates application is SSL now?

Sarun — Fri, 07 Apr 2017 04:08:56 GMT

Since 03/April/2017 02:00 Firewall detect paloalto-updates application as SSL then firewall can't update new signatures because there is no SSL allow in policy.This problem occur to my 3 customer now.

Do anyone have the same problems?

Customer 1Customer 2

Re: Why paloalto-updates application is SSL now?

chinitsara — Fri, 07 Apr 2017 04:46:49 GMT

Me too. I found pan-update application changed to SSL . It occur in PANOS 6.1.x but PANOS 7.1.8 is show pan-update normally and i add SSL application for work around.

Re: Why paloalto-updates application is SSL now?

TranceforLife — Fri, 07 Apr 2017 12:27:07 GMT

The same discussion here but reason is unknown. Works fine with PAN-OS 8.0

Re: Why paloalto-updates application is SSL now?

bradk14 — Fri, 07 Apr 2017 09:17:12 GMT

@chinitsara wrote:
Me too. I found pan-update application changed to SSL . It occur in PANOS 6.1.x but PANOS 7.1.8 is show pan-update normally and i add SSL application for work around.

although this does appear to be a problem and should be addressed as soon as possible, a more elegant solution may be to use an Application Override policy.

out of curiosity, though. for those that are experiencing the issue, if you go to Objects -> Applications and look up the palo-updates app, does it still say ssl is implicitly used? if not, that would be the problem.

ETA: apparently the implicit field isn't shown in 6.x, but hopefully this will work from the command line in configure mode

# show predefined application paloalto-updates | match implicit