Content and Antivirus updates failing

[Anon1]

Anybody else encountering this issue in the last days?

Content and antivirus updates are failing with "Failed to download due to generic communication error. Please try again later."

The internet access itself is OK. The issue seems to be on the Palo Alto Networks side.

[Mick_Ball]

Seems OK for all of my boxes.

are you using the same service route as your internet access...

what happens if you select :-Device/Software/Check Now?

[Anon1]

Thanks for reply.

When I click on "Check Now" it shows new version, but when clicking on "Download" get this "Generic..." error message. After multiple attempts, it eventually works. The mgmt interface is used for download which in the end arrives at the firewall from trust to untrust where I cannot see any dropped traffic regarding "paloalto-updates" appid.

[Mick_Ball]

if you try :-

traceroute source <management ip> host updates.paloaltonetworks.com

does it route to the trusted interface as expected?   perhaps try a few times to see if you have an issue ...

also.. just for a test.. change the updates service route to go via the external interface.

[Anon1]

Routing is all fine to 34.96.84.34

Any idea in which mp-log file there could be more details of this "generic" error?

[Mick_Ball]

my guess would be ms.log but have you tried to change the service route.  just as a test.

[Anon1]

Changing service route is not possible on Panorama.

But I found the issue: Some of the update traffic is now classified as "ssl" and not "paloalto-updates". When you try multiple times, it eventually contacts a download server which is classified as "paloalto-updates". With "ssl" added to the rule, it works now instantly and every time. Thanks for your help.