Download PAN-OS from GUI failing, potential MTU Problem ...

L2 Linker

Download PAN-OS from GUI failing, potential MTU Problem ...

Ok folks


Here's an interesting one for you.


This is to do with connectivity between Panorama and


We can retrieve licence info and download list of updates available for downloads (SW and Threats), but when clicking on download link the connection fails with standard connectivity to updates.palo error, try again later.


This is long shot, but has anyone seen this before?


PAN-OS 8.0.2 VM base image, intending to upgrade to 8.0.7 if the download worked :-/


Ajaz Nawaz


CCIE-RS No.15721

Community Manager

Re: Download PAN-OS from GUI failing, potential MTU Problem ...

Have you tried re-running 'check now' ?


Have you followed the connection through a firewall (packetcapture + global counters) to see what may be happiening, have you seen MTU error messages?


MTU issues can be fixed by changing the MTU and/or setting TCP MSS rewrites, but you'll want to investigate the connection to see what is actually happening before changing these settings

Help the community: Like helpful comments and mark solutions
Reaper out
L2 Linker

Re: Download PAN-OS from GUI failing, potential MTU Problem ...



So its nothing to do with MTU after all.


Currently investigating but is resolving to :


But... in front of Panorama there is a perimeter SRX fw allowing ONLY !


admin@asfdsadfasdf> view-pcap mgmt-pcap mgmt.pcap

17:22:58.515102 IP <ip-addr-removed>.36347 > S 1831023988:1831023988(0) win 14600 <mss 1460,sackOK,timestamp 2046968 0,nop,wscale 7>
17:22:59.192528 IP > <ip-addr-removed>.https: P 17867:18679(812) ack 17555 win 256
17:22:59.192544 IP <ip-addr-removed>.https > . ack 18679 win 330


So it seems we need to introduce another policy on SRXs but they are native fw's not next-gen, so dynamic policy is not an option.


Stay tuned !






L2 Linker

Re: Download PAN-OS from GUI failing, potential MTU Problem ...

Ok so Palo use CDN (Content Delivery Network e.g Akamai), to deliver dynamic updates and downloads. If your network does not allow for the 'Dynamic' nature of CDN in terms of DNS, then modify your update server from:




Or.. architect your network to tolerate and act upon dynamic DNS


Also please take look at this for further details:


Hope this helps !



Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!