Minemeld EDL feed is failing with error in PAN-OS 8.0. Error: "Downloaded file is not a text file Using old copy for refresj." What am I missing here ?
I think I have answered to your question on Slack, but for posterity most probably the problem is a bug in 8.0.0 that has been fixed in 8.0.1.
I'm not sure if this is the right location for this conversation, but I'm not sure what would be the apporpriate group....
I have PAN-OS 8.06 installed, and I'm trying to download a text file as an EDL (similar to how you would download a file from minemeld), however, the URL contains an access key for authentication (i.e., the URL looks like http://someurl.com/file.txt?access_id=<access_id>)
I'm assuming this is causing the "Downloaded file is not a text file" error message. However, the file is indeed a text file.
Has anybody had this issue before?
Thanks for your time...
that error is a generic message error. I would probably start from doing a tcpdump on the management interface to see what's wrong with the communication with the remote server. It could be anything from wrong URL to incompatible sets of SSL ciphers.
Definitely not fixed in 8.0.1 because we are running 8.0.6-h3 and it has started happening to us now as well.
that error is misleading. I would start from checking the ms.log file for additional details, like:
- Certificate Error
- Authentication Errors
I found a solution to my problem at least. It just took some trial and error. I thought my problem was I had a trailing "?tr=1" at the end of my Minemeld server I needed to remove.
The Objects > External Dynamic LIsts > O365-IPv4, the Source was:
With "?tr=1" listed the IPs in CIDR notation (126.96.36.199/31)
Without "?tr=1" listed the IPs as IP ranges (188.8.131.52-184.108.40.206)
As soon as I dropped the "?tr=1" it worked great!
On another note, it's broken again.
Palo Alto Documentation says the correct syntax is either format so I don't know why it stopped working... and yes, that means it was working for at least a month, then on 03/22/2018, it started erroring out...
Now that I'm typing this, it appears to be happening again.
Removing the "?tr=1" fixed it from to 5/03 - 5/16, but now it's erroring out again. ugh...
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!