topic Re: dns-signature cloud service connection refused. in General Topics

dns-signature cloud service connection refused.

Steve_Dussault — Tue, 06 Oct 2020 12:22:37 GMT

Greetings:

I am seeing in the System Log the following message "dns-signature cloud service connection refused" Checking the traffic logs the management IP address is not being blocked. Where do I look to resolve this error message? Thank you.

Re: dns-signature cloud service connection refused.

MP18 — Tue, 06 Oct 2020 13:42:18 GMT

@Steve_Dussault

This also happens if connection to cloud is refused.

Make sure Firewall management interface has connection to cloud

Try this command

show dns-proxy dns-signature info

Regards

Re: dns-signature cloud service connection refused.

Steve_Dussault — Tue, 06 Oct 2020 16:39:57 GMT

MP18:

Here is the results of the command. The firewall has Internet access but for some reason cannot connect to the cloud service?

show dns-proxy dns-signature info

Cloud URL: dns.service.paloaltonetworks.com:443

Last Result: Timeout was reached ( 11 sec ago )

Last Server Address:

Parameter Exchange: Interval 1800 sec

Whitelist Refresh: Interval 86400 sec ( Due 83823 sec )

Request Waiting Transmission: 0

Request Pending Response: 0

Cache Size: 8

ping host dns.service.paloaltonetworks.com
PING dns.service.paloaltonetworks.com (130.211.8.196) 56(84) bytes of data.
^C
--- dns.service.paloaltonetworks.com ping statistics ---
12 packets transmitted, 0 received, 100% packet loss, time 11013ms

ping host updates.paloaltonetworks.com
PING updates.gcp.gslb.paloaltonetworks.com (34.96.84.34) 56(84) bytes of data.
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=1 ttl=113 time=231 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=3 ttl=113 time=229 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=4 ttl=113 time=227 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=5 ttl=113 time=228 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=8 ttl=113 time=228 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=9 ttl=113 time=231 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=10 ttl=113 time=228 ms

Re: dns-signature cloud service connection refused.

Steve_Dussault — Tue, 06 Oct 2020 18:28:36 GMT

show dns-proxy dns-signature info

Cloud URL: dns.service.paloaltonetworks.com:443

Last Result: Timeout was reached ( 11 sec ago )

Last Server Address:

Parameter Exchange: Interval 1800 sec

Whitelist Refresh: Interval 86400 sec ( Due 83823 sec )

Request Waiting Transmission: 0

Request Pending Response: 0

Cache Size: 8

Re: dns-signature cloud service connection refused.

Steve_Dussault — Tue, 06 Oct 2020 18:42:20 GMT

MP:

Here is the output of the command. The firewall does have Internet access and can resolve DNS queries.

show dns-proxy dns-signature info

Cloud URL: dns.service.paloaltonetworks.com:443

Last Result: Timeout was reached ( 11 sec ago )

Last Server Address:

Parameter Exchange: Interval 1800 sec

Whitelist Refresh: Interval 86400 sec ( Due 83823 sec )

Request Waiting Transmission: 0

Request Pending Response: 0

Cache Size: 8

Re: dns-signature cloud service connection refused.

Hammer88 — Mon, 04 Jan 2021 12:10:47 GMT

I have the identical issue, have you been able to resolve it?

Re: dns-signature cloud service connection refused.

Steve_Dussault — Mon, 04 Jan 2021 12:19:29 GMT

I worked with TAC and we were not able to resolve the issue. The firewall is located in China so we believe the issue had to do with "The Firewall of China". The issue since has resolved itself.

Re: dns-signature cloud service connection refused.

Hammer88 — Mon, 04 Jan 2021 12:41:56 GMT

I'll open a TAC case also since the Timeout enhancement has not helped.

Tnx!

Re: dns-signature cloud service connection refused.

KoShy — Tue, 26 Jan 2021 05:45:14 GMT

It seems you have to enable paloalto-dns-security app.

Re: dns-signature cloud service connection refused.

cmuchong — Thu, 17 Mar 2022 15:43:48 GMT

Does anyone have a solution for this? All our firewalls in China are unable to reach "dns.service.paloaltonetworks.com". The result are random DNS requests getting sinkholed and delayed.

show dns-proxy dns-signature info

Cloud URL: dns.service.paloaltonetworks.com:443

Telemetry URL: io.dns.service.paloaltonetworks.com:443

Last Result: Timeout was reached ( 5 sec ago )

Re: dns-signature cloud service connection refused.

Hammer88 — Thu, 17 Mar 2022 16:04:48 GMT

Hi Cmuchong,

Have you tried what @KoShy said? Allowing the paloalto-dns-security app.

This has helped me.

Br,

Re: dns-signature cloud service connection refused.

MP18 — Fri, 18 Mar 2022 16:54:34 GMT

@cmuchong

IF you have checked this url link https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000001Uc6CAE

Then still same issue then please open up TAC case.

Regards

Re: dns-signature cloud service connection refused.

cmuchong — Sun, 22 May 2022 14:09:05 GMT

Thanks all, the solution finally was to upgrade to 9.1.11,10.0.7,10.1.1 (PAN-163800). If upgrade is not possible then a workaround is to use an in-country DNS (within China).

Re: dns-signature cloud service connection refused.

gregdevosenbridge — Fri, 03 Jun 2022 21:11:12 GMT

Looking for resolution for this one and I see no updates for almost 3 months.

My device are not in China and have the same issue.

Any help out there?

Re: dns-signature cloud service connection refused.

Saul_Suarez — Fri, 15 Sep 2023 15:38:45 GMT

I came across this issue and the mgmt internet was in it's own zone, but the zone had the attached security profiles. The firewall lost it's connection to the update server and all traffic and URLs were unable to be classified with a category. Adding a security rule for that zone and IP with no security policies fix the issue for me.

Re: dns-signature cloud service connection refused.

OtakarKlier — Fri, 15 Sep 2023 20:00:51 GMT

Hello,

While a long shot, what about setting up a VPN to a device hosted in the US and tunneling the DNS or all traffic to it?

Regards,