Download PAN-OS from GUI failing, potential MTU Problem ...

Reply
L2 Linker

Download PAN-OS from GUI failing, potential MTU Problem ...

Ok folks

 

Here's an interesting one for you.

 

This is to do with connectivity between Panorama and updates.paloaltonetworks.com

 

We can retrieve licence info and download list of updates available for downloads (SW and Threats), but when clicking on download link the connection fails with standard connectivity to updates.palo error, try again later.

 

This is long shot, but has anyone seen this before?

 

PAN-OS 8.0.2 VM base image, intending to upgrade to 8.0.7 if the download worked :-/

 

Ajaz Nawaz

JNCIE-SEC No.254

CCIE-RS No.15721

Community Manager

Re: Download PAN-OS from GUI failing, potential MTU Problem ...

Have you tried re-running 'check now' ?

 

Have you followed the connection through a firewall (packetcapture + global counters) to see what may be happiening, have you seen MTU error messages?

 

MTU issues can be fixed by changing the MTU and/or setting TCP MSS rewrites, but you'll want to investigate the connection to see what is actually happening before changing these settings


Help the community: Like helpful comments and mark solutions
Reaper out
L2 Linker

Re: Download PAN-OS from GUI failing, potential MTU Problem ...

hmmm..

 

So its nothing to do with MTU after all.

 

Currently investigating but updates.paloaltonetworks.com is resolving to :

 

a92-122-165-117.deploy.akamaitechnologies.com.https

 

But... in front of Panorama there is a perimeter SRX fw allowing updates.paloaltonetworks.com ONLY !

 

admin@asfdsadfasdf> view-pcap mgmt-pcap mgmt.pcap

17:22:58.515102 IP <ip-addr-removed>.36347 > a92-122-165-117.deploy.akamaitechnologies.com.https: S 1831023988:1831023988(0) win 14600 <mss 1460,sackOK,timestamp 2046968 0,nop,wscale 7>
17:22:59.192528 IP fl-7034162.sc.reg.net.51362 > <ip-addr-removed>.https: P 17867:18679(812) ack 17555 win 256
17:22:59.192544 IP <ip-addr-removed>.https > fl-7034162.sc.reg.net.51362: . ack 18679 win 330

 

So it seems we need to introduce another policy on SRXs but they are native fw's not next-gen, so dynamic policy is not an option.

 

Stay tuned !

 

Ajaz

 

 

 

L2 Linker

Re: Download PAN-OS from GUI failing, potential MTU Problem ...

Ok so Palo use CDN (Content Delivery Network e.g Akamai), to deliver dynamic updates and downloads. If your network does not allow for the 'Dynamic' nature of CDN in terms of DNS, then modify your update server from:

 

updates.paloaltonetworks.com

 

TO

 

staticupdates.paloaltonetworks.com

 

Or.. architect your network to tolerate and act upon dynamic DNS

 

Also please take look at this for further details:

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/threat-prevention/content-delivery-n...

 

Hope this helps !

 

Ajaz

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!