topic Re: Content and Antivirus updates failing in General Topics

Content and Antivirus updates failing

Anon1 — Mon, 16 Dec 2019 14:49:25 GMT

Anybody else encountering this issue in the last days?

Content and antivirus updates are failing with "Failed to download due to generic communication error. Please try again later."

The internet access itself is OK. The issue seems to be on the Palo Alto Networks side.

Re: Content and Antivirus updates failing

Mick_Ball — Mon, 16 Dec 2019 15:26:07 GMT

Seems OK for all of my boxes.

are you using the same service route as your internet access...

what happens if you select :-Device/Software/Check Now?

Re: Content and Antivirus updates failing

Anon1 — Mon, 16 Dec 2019 16:29:06 GMT

Thanks for reply.

When I click on "Check Now" it shows new version, but when clicking on "Download" get this "Generic..." error message. After multiple attempts, it eventually works. The mgmt interface is used for download which in the end arrives at the firewall from trust to untrust where I cannot see any dropped traffic regarding "paloalto-updates" appid.

Re: Content and Antivirus updates failing

Mick_Ball — Mon, 16 Dec 2019 16:38:32 GMT

if you try :-

traceroute source <management ip> host updates.paloaltonetworks.com

does it route to the trusted interface as expected? perhaps try a few times to see if you have an issue ...

also.. just for a test.. change the updates service route to go via the external interface.

Re: Content and Antivirus updates failing

Anon1 — Mon, 16 Dec 2019 16:47:42 GMT

Routing is all fine to 34.96.84.34

Any idea in which mp-log file there could be more details of this "generic" error?

Re: Content and Antivirus updates failing

Mick_Ball — Mon, 16 Dec 2019 17:03:10 GMT

my guess would be ms.log but have you tried to change the service route. just as a test.

Re: Content and Antivirus updates failing

Anon1 — Tue, 17 Dec 2019 12:41:17 GMT

Changing service route is not possible on Panorama.

But I found the issue: Some of the update traffic is now classified as "ssl" and not "paloalto-updates". When you try multiple times, it eventually contacts a download server which is classified as "paloalto-updates". With "ssl" added to the rule, it works now instantly and every time. Thanks for your help.