Unable To Connect To MineMeld Output URL Via EDL

L1 Bithead

Unable To Connect To MineMeld Output URL Via EDL

Setup an EDL in Panorama to grab a IPv4 feed from a Minemeld (Autofocus hosted) output.  Verified the EDL was pushed down to one of our PA-5050's and clicked on 'Import Now' from the 5050.  EDL is not able to connect and system log shows following:

"Unable to fetch external dynamic list. HTTP response code said error Using old copy for refresh."

 

When clicking on 'Test Source URL' a pop-up states "URL access error".

 

Using curl locally from my desktop I am able to successfully connect to the Minemeld output URL feed with the configured username/password.  Triple checked that credentials in the EDL match that of what is set in the user feed username and that the correct tag is assigned to both the username and Output Node. Also created a username under the Admin Feed and configured the EDL to use those credentials but got the same response.  Changed the tag on the Output Node to 'any' and that also does not work when trying to connect from the 5050.  It seems the only way the 5050 can connect to the URL is if the Output Node is set to 'anonymous' - which we would rather not do. 

 

Can't seem to find any logs with the AF hosted instance of Minemeld that would show the 5050 attempting to connect.  Any help/ideas are more then appreciated!  Thanks!

L7 Applicator

Re: Unable To Connect To MineMeld Output URL Via EDL

Hi @jdemery,

I do agree *anonymous* is not a soluton. You should create a feed user, an access tag and then associate that tag with the feed.

See here:

https://www.paloaltonetworks.com/documentation/autofocus/autofocus/autofocus_admin_guide/autofocus-a...

L1 Bithead

Re: Unable To Connect To MineMeld Output URL Via EDL

Thanks for the feedback...that's actually the instruction set I followed when first setting up the EDL to pull from the Output Node I have setup in MineMeld.  The strange thing is that I if I use curl locally from my desktop (or anywhere) I can connect successfully using the credentials I have setup as a feed user.  Using the same credentials I can not connect from the firewall.  I have triple checked the credentials just to be sure nothing was fat-fingered.

L7 Applicator

Re: Unable To Connect To MineMeld Output URL Via EDL

Hi @jdemery,

you can do 2 things:

- check the ms.log file on the firewall to see which error is returned by the EDL download process

- download the API log from MineMeld (System > Dashboard > API > Logs). There you should find the URL requested by the firewall and see if there is a 401 erorr (Unauthorized) or something else

 

Thanks,

luigi

L1 Bithead

Re: Unable To Connect To MineMeld Output URL Via EDL

This started working after Panorama was upgraded from 8.0.2 to 8.0.3-h4 and our firewall upgraded from 7.1.9 to 8.0.3-h4.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!