topic Re: Apple Software Updates Issue with Palo Alto in General Topics

Apple Software Updates Issue with Palo Alto

Jatin.Singh — Mon, 12 Jul 2021 01:36:28 GMT

Hi,

If we try to update apps on a iPhone they don’t update but if we remove the security profiles the apps update with no issues.

When you click update it attempts to do the download and just fails

We are using following security profiles(image attached). We think this may actually be a bug.

The update is only successful if the rule has NO profiles attached.

We just turned them off one by one, nothing worked until they where all off.

We attached the wildfire profile only, it stopped working.

We attached the alert only file blocking policy and it stopped working.

We do not SSL decryption configured. Users are directly connected with Palo Alto over WLAN not VPN.

Re: Apple Software Updates Issue with Palo Alto

MP18 — Mon, 12 Jul 2021 04:14:50 GMT

@Jatin.Singh

Please check logs for Wildfire submissions and look for action also check threat, and data filtering logs.

Here you will see why and which security profile is blocking the connection.

Regards

Re: Apple Software Updates Issue with Palo Alto

Shehriyar — Mon, 12 Jul 2021 05:48:43 GMT

Could you please share the individual profile settings you are mapping.

Also, could you please try, attaching all profiles except WildFire Analysis Profile and check if it works.

Re: Apple Software Updates Issue with Palo Alto

Jatin.Singh — Tue, 13 Jul 2021 01:47:31 GMT

@MP18 nothing in the logs indicating a block, either traffic or threat

I attached the alert only file blocking policy and it stopped working.

I just turned them off one by one, nothing worked until they where all off.

I attached the wildfire profile only, it stopped working.

Re: Apple Software Updates Issue with Palo Alto

MP18 — Tue, 13 Jul 2021 02:40:29 GMT

@Jatin.Singh

Looking at the profile settings we can not tell how traffic is blocked.

You need to check Under Monitor

traffic,Threat,url-filtering, wildfire and other logs for specific source and destinations why traffic is blocked.

Regards

Re: Apple Software Updates Issue with Palo Alto

Jatin.Singh — Tue, 13 Jul 2021 02:59:14 GMT

We have already checked and cannot see any blocked traffic

We have made simple test policy

Also without any profiles attached it works, and then we attached File Blocking alert only profile and it stopped working.

Alert only profile will not block the updates? And no other profile was attached while testing it.

Rule is allowing all from the source as seen above

Re: Apple Software Updates Issue with Palo Alto

BPry — Tue, 13 Jul 2021 17:45:19 GMT

@Jatin.Singh,

What version of PAN-OS do you have installed? I've never had an issue with iOS updates downloading properly with a full suite of profiles applied to the traffic, including a profile that directly matches your "Alert-Only-FB" settings.

Re: Apple Software Updates Issue with Palo Alto

Jatin.Singh — Thu, 15 Jul 2021 23:26:45 GMT

Raised the issue with TAC and they found the issue as mentioned in the below KB

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POjhCAG&lang=en_US%E2%80%A9

By enabling "Allow HTTP partial response" issue got resolved

Under Device->Setup->Content-ID->Content-ID Settings

Re: Apple Software Updates Issue with Palo Alto

MP18 — Fri, 16 Jul 2021 05:03:44 GMT

@Jatin.Singh

Thanks for letting us know.

Regards

Mahesh

Re: Apple Software Updates Issue with Palo Alto

pendergrass54 — Fri, 16 Jul 2021 07:04:17 GMT

This works really well for us, thank you! Facing same issue here. Help is appreciated.