topic Re: Firewall rules for palo alto to update the content (anti-virus,signatur in General Topics

Firewall rules for palo alto to update the content (anti-virus,signature...

herman2018 — Tue, 01 Sep 2020 06:24:09 GMT

Hi, anyone can advise how to configure the firewall rule for palo alto to update its contents? Thanks in advance.

Re: Firewall rules for palo alto to update the content (anti-virus,signatur

reaper — Tue, 01 Sep 2020 11:07:29 GMT

if you've upgraded to 9.1 or later, you can leverage the palo alto tag in an application filter to dynamically allow all connections needed by your firewalls.

using this filter in a security rule will allow outbound connections and if ever a new service is added, or an existing one is changed, the filter will account for these automatically

Re: Firewall rules for palo alto to update the content (anti-virus,signatur

herman2018 — Tue, 01 Sep 2020 12:12:54 GMT

Thanks for the reply @reaper . But not only for application update, also for other update (anti-virus, IPS...). Out PA the management interface is connected to internal network , so how should create a firewall rule for PA update? I tried to create a rule to let management subnet outgoing traffic, but when click downloading under Dynamic update , it still shows failed. Can you please what firewall rules need for palo alto update? thanks

Re: Firewall rules for palo alto to update the content (anti-virus,signatur

reaper — Tue, 01 Sep 2020 12:25:07 GMT

All of the services and updates are included in that application filter, the only exception is when your firewall is not using your internal DNS and needs to reach out to an internet DNS, in which case you need to also allow outbound DNS, and possibly ntp and ping to sync time and troubleshoot

if you do not have access to the application filter TAG, you will need the following applications for basic services, more may be required depending on your deployment)

- paloalto-dns-security

- paloalto-updates

- paloalto-wildfire-cloud

Re: Firewall rules for palo alto to update the content (anti-virus,signatur

herman2018 — Tue, 01 Sep 2020 12:29:19 GMT

Thanks @reaper . PA will use management IP or external IP address to download the updates?

Re: Firewall rules for palo alto to update the content (anti-virus,signatur

reaper — Tue, 01 Sep 2020 12:37:13 GMT

by default all connections come out of the management interface, but you can change the egress interface via service routes:

Re: Firewall rules for palo alto to update the content (anti-virus,signatur

AlexandroDelAngel — Fri, 05 Mar 2021 15:37:03 GMT

Nice, I'll give it a try with this filter.

Thanks for the recommendation!

Re: Firewall rules for palo alto to update the content (anti-virus,signatur

AlexandroDelAngel — Fri, 05 Mar 2021 15:40:39 GMT

Do you think it would be ok if I lock it down to destination FQDN Object updates.paloaltonetworks.com ?

Regards,