topic Re: Failed O365 Updates in General Topics

Failed O365 Updates

ImranRazaq — Mon, 07 Jun 2021 09:55:35 GMT

We have two sites running PA-3020, one site is able to download O365 updates but the second site fails to download and install the updates. Not sure what im supposed to be setting on the 2nd Palo Alto to get this working.

They are both running 9.0.12 update

Re: Failed O365 Updates

Remo — Mon, 07 Jun 2021 10:25:34 GMT

Hi @ImranRazaq

Some more informations would be helpful. Like ...

Is the security policy the same on both firewalls?
Do you have url filtering enabled?
Do you have decryption enabled?
Did you check the logs if you see something blocked?
Did you check locally on a client so see which connection exactly isn't working (to which url)?

Re: Failed O365 Updates

ImranRazaq — Mon, 07 Jun 2021 11:53:12 GMT

I cant seem to locate the security policy which allows traffic to pass through.

URL filtering is enabled on both
Decryption is enabled on the working on and not on the non working one

Re: Failed O365 Updates

BPry — Tue, 08 Jun 2021 02:08:47 GMT

@ImranRazaq,

Since your configuration isn't the same between working and non-working units I would toss the fact that one of your sites is working out of the window. Troubleshoot the same way you would for anything else that is broken and ignore the working site all-together since they aren't actually the same (or at least, your comment makes them seem to not be the same).

Take a single "test" client that you can use at the non-working site and enable full logging for that client and take a packet capture of all of the traffic. When the update fails, review the firewall and the packet capture to identify what actually isn't being allowed to pass through the firewall. Chances are you'll see the traffic getting denied in your firewall logs and you won't have to go through the packet capture.

Re: Failed O365 Updates

ImranRazaq — Wed, 09 Jun 2021 14:49:17 GMT

ive ran packet capture on the firewall and getting below results from the wireshark

ive tried this on the working firewall with the below results