topic Unable to download updates in General Topics

Unable to download updates

Jafar_Hussain — Fri, 24 Jul 2020 18:09:19 GMT

Hello,

When i download the PAN-OS or content update getting below error:-

Troubleshooting performed from my side:-

I can see all the services are running via the management plane.
I checked the connectivity between the management interface and the internet it was working fine.
I checked the traceroute from the firewall towards the update server of Paloalto, it was working perfectly.
Then I put ip address instead of the URL in the update server. But still, the issue persists.
We tried to download the dynamic updates but the same issue is happening.
In the last, we restarted the management server.

Can Any one suggest on this what i need to check.

Re: Unable to download updates

Remo — Fri, 24 Jul 2020 18:49:37 GMT

Hi @Jafar_Hussain

How did you check the connectivity between the mgmt interface and the internet? Is the connection traversing another firewall where may be tls decryption is enabled? Did this suddenly stop working or was it never working? Do you have a dns server configured? If there is another firewall or even the same make sure the traffic is allowed and either tls decryption disabled or then the checkbox at "check update server identity".

Re: Unable to download updates

Jafar_Hussain — Fri, 24 Jul 2020 18:57:10 GMT

@RemoPlease find the answer below:-

How did you check the connectivity between the mgmt interface and the internet?- I can able to ping google.com and 8.8.8.8 through management interface.

Is the connection traversing another firewall where may be tls decryption is enabled? - No decryption policy is configured.

Did this suddenly stop working or was it never working? - I think, the last content update downloaded before 8 months.

Do you have a dns server configured?- Yes

If there is another firewall or even the same make sure the traffic is allowed and either tls decryption disabled or then the checkbox at "check update server identity". - Checkbox is checked in verify server identity.

Re: Unable to download updates

MP18 — Sat, 25 Jul 2020 03:38:43 GMT

@Jafar_Hussain

As per your info seems all is configured correctly.

This type of error normally comes if any firewall in path is doing ssl decryption and on this PA verify update server identity is checked.

1>>Can you please verify what you have configured under update server?

See if you can ping updates.paloaltonetworks.com

2>>Also if you verify and test number 1 then only thing i can say is uncheck the verify server identity

Regards

MAhesh

Re: Unable to download updates

reaper — Sun, 26 Jul 2020 20:47:39 GMT

as mentioned above, have you checked if URL filtering is maybe blocking (or presenting a 'continue') your dynamic updates

this one may sound silly, but have you tried hitting the 'check now'

last resort (try the silly one first)

debug swm rebuild-content-db

Re: Unable to download updates

Jafar_Hussain — Mon, 27 Jul 2020 18:11:01 GMT

@MP18

Thank you.

Once i uncheck the verify server identity and delete previous PAN-OS version after that i can able to download software.