Apple Software Updates Issue with Palo Alto

[Jatin.Singh]

Hi,

If we try to update apps on a iPhone they don’t update but if we remove the security profiles the apps update with no issues.

When you click update it attempts to do the download and just fails

We are using following security profiles(image attached). We think this may actually be a bug.

The update is only successful if the rule has NO profiles attached.

We just turned them off one by one, nothing worked until they where all off.

We attached the wildfire profile only, it stopped working.

We attached the alert only file blocking policy and it stopped working.

We do not SSL decryption configured. Users are directly connected with Palo Alto over WLAN not VPN.

[MP18]

@Jatin.Singh 

Please check logs for  Wildfire submissions and look for action also check threat, and data filtering logs.

Here you will see why and which security profile is blocking the connection.

Regards

[Shehriyar]

Could you please share the individual profile settings you are mapping.

Also, could you please try, attaching all profiles except WildFire Analysis Profile and check if it works.

[Jatin.Singh]

@MP18 nothing in the logs indicating a block, either traffic or threat 

I attached the alert only file blocking policy and it stopped working.

I just turned them off one by one, nothing worked until they where all off.

I attached the wildfire profile only, it stopped working.

[MP18]

@Jatin.Singh 

Looking at the profile settings we can not tell how traffic is blocked.

You need to check Under Monitor 

traffic,Threat,url-filtering, wildfire and other logs for specific source and destinations why traffic is blocked.

Regards

[Jatin.Singh]

We have already checked and cannot see any blocked traffic 

We have made simple test policy 

Also without any profiles attached it works, and then we attached File Blocking alert only profile and it stopped working.

Alert only profile will not block the updates? And no other profile was attached while testing it.

Rule is allowing all from the source as seen above

[BPry]

@Jatin.Singh,

What version of PAN-OS do you have installed? I've never had an issue with iOS updates downloading properly with a full suite of profiles applied to the traffic, including a profile that directly matches your "Alert-Only-FB" settings. 

[Jatin.Singh · Accepted solution]

Raised the issue with TAC and they found the issue as mentioned in the below KB

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POjhCAG&lang=en_US%E2%80%A...

By enabling "Allow HTTP partial response" issue got resolved

Under Device->Setup->Content-ID->Content-ID Settings 

[MP18]

@Jatin.Singh 

Thanks for letting us know.

Regards

Mahesh

[pendergrass54]

This works really well for us, thank you! Facing same issue here. Help is appreciated.