topic Re: Panorama - dynamic updates not working in General Topics

Panorama - dynamic updates not working

raji_toor — Thu, 27 Sep 2018 19:07:26 GMT

Software Version 8.0.9

Application Version 8024-474

Panorama VM is not receiving dynamic updates. I have checked traffic is allowed and also license is not expired.

On manual check it is getting this error.

Also tried updating by directly uploading the file. Apps+Threats file uploaded but gave error below.

Apps file uploaded and it was able to get installed. But i think now Panorama does not have any Threat information.

Re: Panorama - dynamic updates not working

gwesson — Thu, 27 Sep 2018 19:50:12 GMT

For the communication error, the simplest reason is usually that DNS hasn't been set up (or is not reachable). From Panorama's CLI, see if you can get the IP from the ping command. Note that you won't get a response from ping, but you should see the IP resolve:

> ping host updates.paloaltonetworks.com
PING updates.inap.gslb.paloaltonetworks.com (199.167.52.141) 56(84) bytes of data.
^C
--- updates.inap.gslb.paloaltonetworks.com ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 2999ms

As for the manual upload, you can't upload the App+Threat to Panorama since it has no concept of threats for itself. You would need just the App package ("panupv2-all-apps") if you're uploading to it manually.

Re: Panorama - dynamic updates not working

raji_toor — Thu, 27 Sep 2018 20:33:25 GMT

@gwesson DNS is setup but as you said PA IP does not respond.

Panorama> ping host updates.paloaltonetworks.com
PING updates.inap.gslb.paloaltonetworks.com (199.167.52.141) 56(84) bytes of data.
^C
--- updates.inap.gslb.paloaltonetworks.com ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3004ms

Re: Panorama - dynamic updates not working

gwesson — Thu, 27 Sep 2018 20:43:18 GMT

Good deal.

You blocked out the source IP address, so hopefully it's a NAT address. If you're not doing source NAT, then you'll need to do that as well so the responses can be routed back to your Panorama management IP. If the NAT is good, your best bet may be to open a support case.

Re: Panorama - dynamic updates not working

raji_toor — Thu, 27 Sep 2018 20:48:23 GMT

TAC case it will be then. Thanks.