topic Re: Wildfire Events "failed to establish or resume a secure session" in General Topics

Wildfire Events "failed to establish or resume a secure session"

Alpalo — Wed, 15 Sep 2021 15:56:20 GMT

Hello

I Have a Cluster active-passive PA-820 version 10.0.7

I am receiving the following system events continuously

I have configured eu.wildfire.paloaltonetworks.com and wildfire.paloaltonetworks.com but the problem persists.

Can someone help me?

Thanks so much

Re: Wildfire Events "failed to establish or resume a secure session"

LAYER_8 — Wed, 15 Sep 2021 16:19:34 GMT

Are you decrypting outbound sessions? You will likely want to add a few domains to a decryption exclusion:

updates.paloaltonetworks.com/
proditpdownloads.paloaltonetworks.com/
staticupdates.paloaltonetworks.com/
*.urlcloud.paloaltonetworks.com
database.brightcloud.com
service.brightcloud.com
c733.r33.cf1.rackcdn.com
staticupdates.paloaltonetworks.com
wildfire.paloaltonetworks.com
*.wildfire.paloaltonetworks.com

Re: Wildfire Events "failed to establish or resume a secure session"

Alpalo — Thu, 16 Sep 2021 07:00:04 GMT

Hello Slick

Thanks for your answer but I don't understand

Could you explain us where and how we can change it?

Regards

Re: Wildfire Events "failed to establish or resume a secure session"

Alpalo — Thu, 16 Sep 2021 08:22:38 GMT

I have configured this *.wildfire.paloaltonetworks.com .

but I don't have configure SSL Decrypt

Re: Wildfire Events "failed to establish or resume a secure session"

PavelK — Thu, 16 Sep 2021 12:55:08 GMT

Hi @Alpalo thank you for information.

Would it be possible to check the output of: "show wildfire status" to see more details? Here is link for further troubleshooting tips: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000oMCYCA2&lang=en_US%E2%80%A9

Kind Regards

Pavel

Re: Wildfire Events "failed to establish or resume a secure session"

Alpalo — Thu, 16 Sep 2021 13:30:33 GMT

Hello Pavel

Thanks for your answer, the problem is the Wildfire License :

show wildfire status

Connection info:
Signature verification: enable
Server selection: enable
File cache: enable

WildFire Public Cloud:
Server address: eu.wildfire.paloaltonetworks.com
Best server:
Device registered: no
Through a proxy: no
Valid wildfire license: no
Service route IP address:
Global status: SSL/TLS handshake failure
Count of available workers: 20
Available worker indices: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
Upload status Usage: 'I': Idle, 'U': Uploading, 'Q': Querying
Upload worker index: 0 1 2 3 4 5 6 7 8 9
Upload status: I I I I I I I I I I
Status time (seconds): 24 24 24 24 24 24 24 24 24 24
Upload worker index: 10 11 12 13 14 15 16 17 18 19
Upload status: I I I I I I I I I I
Status time (seconds): 24 24 24 24 24 24 24 24 24 24

WildFire Private Cloud:
Server address:
Best server:
Device registered: no
Through a proxy: no
Valid wildfire license: no
Service route IP address:
Global status: Disabled due to configuration
Count of available workers: 0
Available worker indices:
Upload status Usage: 'I': Idle, 'U': Uploading, 'Q': Querying
Upload worker index: 0 1 2 3 4 5 6 7 8 9
Upload status: Idle Idle Idle Idle Idle Idle Idle Idle Idle Idle
Status time (seconds): 999+ 999+ 999+ 999+ 999+ 999+ 999+ 999+ 999+ 999+
Upload worker index: 10 11 12 13 14 15 16 17 18 19
Upload status: Idle Idle Idle Idle Idle Idle Idle Idle Idle Idle
Status time (seconds): 999+ 999+ 999+ 999+ 999+ 999+ 999+ 999+ 999+ 999+

File size limit info:
pe 16 MB
apk 10 MB
pdf 3072 KB
ms-office 16384 KB
jar 5 MB
flash 5 MB
MacOSX 10 MB
archive 50 MB
linux 50 MB
script 20 KB

Forwarding info:
file idle time out (second): 90
total bytes of concurrent files: 0
Public Cloud:
total file fwded : 0
total file failed: 0
total session info. upload failed: 0
total file skipped: 0
total cloud queries: 0
total cloud queries failed: 0
file forwarded in last minute: 0
bytes of concurrent files: 0
Private Cloud:
total file fwded : 0
total file failed: 0
total session info. upload failed: 0
total file skipped: 0
total cloud queries: 0
total cloud queries failed: 0
file forwarded in last minute: 0
bytes of concurrent files: 0

but ... Do you know how I can remove the messages from the system?

thanks for your help 🙂

Re: Wildfire Events "failed to establish or resume a secure session"

Alpalo — Thu, 16 Sep 2021 13:35:24 GMT

Hello,

Thanks for your answer, the problem is that I have not license for it:

show wildfire status

Connection info:
Signature verification: enable
Server selection: enable
File cache: enable

WildFire Public Cloud:
Server address: eu.wildfire.paloaltonetworks.com
Best server:
Device registered: no
Through a proxy: no
Valid wildfire license: no

But...Do you know how I can remove the messages from the system?

Re: Wildfire Events "failed to establish or resume a secure session"

TomYoung — Thu, 16 Sep 2021 14:00:32 GMT

Hi @Alpalo ,

I believe this is what you are looking for -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClyXCAS.

Thanks,

Tom

Re: Wildfire Events "failed to establish or resume a secure session"

Alpalo — Fri, 17 Sep 2021 06:36:38 GMT

I still continues with the problem...

delete deviceconfig system update-schedule wildfire

Object doesn't exist --------------

Any other suggest?

Regards

Re: Wildfire Events "failed to establish or resume a secure session"

TomYoung — Sat, 18 Sep 2021 18:04:54 GMT

Hi @Alpalo ,

That's strange. Do you have a valid Threat Prevention license? What licenses are active under Device > Licenses? If you have a Threat Prevention license you still should be able get WildFire signature updates every 24-48 hours. The object should not be completely gone.

What do you see under Device > Dynamic Updates? Is there an update schedule for WildFire? The CLI command refers to that section.

if you don't have a Threat license, try the CLI command "delete deviceconfig system update-schedule" without the wildfire parameter. That should delete all dynamic update schedules. You can then add the licensed ones back.

Thanks,

Tom

Re: Wildfire Events "failed to establish or resume a secure session"

Alpalo — Mon, 20 Sep 2021 07:45:09 GMT

Hello,

Yes I have a valid Threat Prevention license... Yes... That's strange...

Re: Wildfire Events "failed to establish or resume a secure session"

TomYoung — Mon, 20 Sep 2021 12:21:39 GMT

Hi @Alpalo ,

Your NGFW is still trying to connect to WildFire every minute like the update-schedule is still there. Maybe the config is in the CLI, but not the GUI. Could you run the commands > "set cli config-output-format set", > "configure", and # "show deviceconfig system update-schedule"? If the wildfire is still there, I would delete the whole section with "delete deviceconfig system update-schedule" and then add the pieces that you want back. You can copy and paste the CLI for the other sections to quickly add them back. You can also "commit" on the CLI.

Thanks,

Tom

Re: Wildfire Events "failed to establish or resume a secure session"

Alpalo — Mon, 20 Sep 2021 13:23:17 GMT

That is the configuration:

show deviceconfig system update-schedule
set deviceconfig system update-schedule threats recurring sync-to-peer yes
set deviceconfig system update-schedule threats recurring daily at 02:00
set deviceconfig system update-schedule threats recurring daily action download-and-install
set deviceconfig system update-schedule anti-virus recurring sync-to-peer yes
set deviceconfig system update-schedule anti-virus recurring daily at 03:00
set deviceconfig system update-schedule anti-virus recurring daily action download-and-install

Re: Wildfire Events "failed to establish or resume a secure session"

TomYoung — Mon, 20 Sep 2021 18:48:06 GMT

I would delete the whole section, commit, then paste the 6 lines back, and commit again.

Re: Wildfire Events "failed to establish or resume a secure session"

Alpalo — Wed, 22 Sep 2021 08:16:10 GMT

Hello,

I still have the problem, I was not able to delete the events...

Any idea or suggest?

Thanks

Re: Wildfire Events "failed to establish or resume a secure session"

emmyfreed24 — Wed, 22 Sep 2021 08:25:57 GMT

Hey,

collarspace

All the best !

Re: Wildfire Events "failed to establish or resume a secure session"

Alpalo — Wed, 22 Sep 2021 10:56:25 GMT

Hello,

Thanks for your response...but I I tried to do it before but it doesn't work...

I still have the events

this are the config and events:

show deviceconfig system update-schedule
set deviceconfig system update-schedule threats recurring sync-to-peer yes
set deviceconfig system update-schedule threats recurring daily at 02:00
set deviceconfig system update-schedule threats recurring daily action download-and-install
set deviceconfig system update-schedule anti-virus recurring daily at 03:00
set deviceconfig system update-schedule anti-virus recurring daily action download-and-install
set deviceconfig system update-schedule anti-virus recurring sync-to-peer yes
[edit]

Re: Wildfire Events "failed to establish or resume a secure session"

TomYoung — Wed, 22 Sep 2021 13:39:42 GMT

Hi @Alpalo ,

You did this? Once you do the command it should be blank.

admin@ngfw# delete deviceconfig system update-schedule

[edit]
admin@ngfw# show deviceconfig system update-schedule

[edit]
admin@ngfw#

Thanks,

Tom

Re: Wildfire Events "failed to establish or resume a secure session"

Alpalo — Wed, 22 Sep 2021 13:50:14 GMT

Yes but the problem still continues, I will open a ticket with Paloalto Tac.

Regards