topic Dynamic updates failing since the 18th.... in General Topics

Dynamic updates failing since the 18th....

RobinClayton — Fri, 20 Dec 2019 17:08:41 GMT

Some of our PA's are failing to get updates with a "generic communication failure"

They go out the same rule on one PA.

The DR site seems to be ok.

DNS and trace route seem fine...

Rob

Re: Dynamic updates failing since the 18th....

Mick_Ball — Fri, 20 Dec 2019 17:32:28 GMT

Hmmm this was posted earlier this month, here was the resolution, HTH.

But I found the issue: Some of the update traffic is now classified as "ssl" and not "paloalto-updates". When you try multiple times, it eventually contacts a download server which is classified as "paloalto-updates". With "ssl" added to the rule, it works now instantly and every time. Thanks for your help.

Re: Dynamic updates failing since the 18th....

OtakarKlier — Fri, 20 Dec 2019 22:09:22 GMT

Hello,

We also had ours do the same thing. My guess is that it was an issue on PAN's side. However today all of mine are getting updates. Maybe check the traffic logs to see if they are getting blocked on your side? By default they will check from the management port.

Regards,

Re: Dynamic updates failing since the 18th....

RobinClayton — Mon, 23 Dec 2019 08:44:44 GMT

It's working now.

Pulling from "199.167.52.141"

It was failing on "34.84.96.34"

Prior to the issue it seemed to be trying both,

During the issue just trying 34.84....

Now just using 199.167....

So I guess they have a broken repository.

Re: Dynamic updates failing since the 18th....

RobinClayton — Fri, 10 Jan 2020 08:59:53 GMT

So, to hopefully conclude this..

After going back to support a few times, they have finally said that "Senior Resource" has said they are migrating to Google Cloud. And had received reports that users could not connect. etc..

My summary. Failed service migration by PA, nothing to do with our hardware, configuration or internet.

Cheers

Rob

Re: Dynamic updates failing since the 18th....

JonIvarLarsen — Fri, 10 Jan 2020 13:14:13 GMT

I'm having a somewhat similar issue, but this has to do with the schedule itself. For instance, I have App & Threat set to download and install every hour. The schedule runs, and returns (in System Log) "Auto update agent found no new Content updates".

However, if I manually refresh the new updates will appear. On the next schedule the download start and install. I tried this on 2 PA-220's: same schedule and I manually refreshed one of them. And sure enough, the one that I did not manually refresh stayed put on the old content.

This is driving me mad

Re: Dynamic updates failing since the 18th....

Anon1 — Fri, 10 Jan 2020 13:39:05 GMT

We encounter the same in a global PA deployment.

Automatic content updates dont work anymore, triggering it manually on the device works fine.

However, automatic antivirus updates still work fine.

Re: Dynamic updates failing since the 18th....

JonIvarLarsen — Fri, 10 Jan 2020 13:49:11 GMT

Sounds like the exact same issue. Do you have Panorama in your environment? We encounter the same issue on Panorama app/threat.

On a few firewalls that have not yet been connected to Panorama, it seems like the content works as well. We did have an issue with it not updating in december, but disabling the schedules (content & av), commiting, enabling the schedules and commiting seemed to resolve the issue.

Re: Dynamic updates failing since the 18th....

Anon1 — Fri, 10 Jan 2020 14:00:13 GMT

Yes, Panorama itself has the same issue with content updates. Download and install schedules are pushed from Panorama to devices via template setting.

Re: Dynamic updates failing since the 18th....

RobinClayton — Fri, 10 Jan 2020 15:05:51 GMT

I am guessing it's somewhat geographical [I am in the UK], and the GOOGLE CDN address I WAS getting would not be the same as say the one for the US. Which may account for it not affecting a wider audience.

Rob

Re: Dynamic updates failing since the 18th....

DPoppleton — Fri, 10 Jan 2020 16:32:44 GMT

Wow, we just noticed this the other day. Since the 12/17 our updates have been failing. Do it manually and it worked fine. I opened a case but they said to restart the management plane.

Re: Dynamic updates failing since the 18th....

JonIvarLarsen — Mon, 13 Jan 2020 07:23:06 GMT

I've restarted a few of the firewalls and also upgrading them to 9.0.4 without any improvement. So I guess restarting the Management plane won't do much good.

Re: Dynamic updates failing since the 18th....

JonIvarLarsen — Wed, 15 Jan 2020 08:09:07 GMT

Seems like our firewalls are acting normally now when it comes to content updates. How about you guys?

Re: Dynamic updates failing since the 18th....

RobinClayton — Wed, 15 Jan 2020 10:26:57 GMT

I don't think we have seen and issue since late December.

Rob

Re: Dynamic updates failing since the 18th....

DPoppleton — Thu, 16 Jan 2020 13:30:38 GMT

Me too. We had 16 out of 18 firewalls not updating, but they all grabbed the last update without a problem.