dns-signature cloud service connection refused / kicked-off vpn

[fhewiufhwefhwe]

VPN just kicked every off for a couple minutes.  I had a dozen logs forwarded to me saying dns-signature cloud service connection refused.  Anyone know if that might be the cause?  When I was able to reconnect to VPN, the # of sessions was 3-5x normal and quickly dropped.

[BPry]

@fhewiufhwefhwe,

That sounds more like an ISP, DoS, or Zone Protection Profile issue more than anything else. A high number of sessions that drops isn't shocking after an outage like that, so that's really nothing to go off of. Do you have any external monitoring that could alert you of temporary ISP outages? 

[fhewiufhwefhwe]

No, I don't have temporary external monitoring.  Do you have a recommendation?  I have looked at downdetector.  I also have internal SNMP monitoring setup, and no alerts were generated.  For DoS / Zone Protection, I am using SYN cookies, and excluding internal zones and the DNS resolvers that we use after finding those policies caused problems with exclusions.

[ice-quake]

The "dns-signature cloud service connection refused" is related to the DNS Security feature.  You'll need to allow your firewall management interfaces to connect to Palo's update servers - use the "paloalto-dns-security" App ID in firewall policy (assuming the mgmt. interface outbound traffic will transverse a Palo Alto firewall).  This may cause issues with DNS resolution if not resolved - depends on your policy/anti-spyware profile settings.  I'm not able to make any recommendation regarding your VPN issue without more details.  GlobalProtect?  Site to site?  Generic VPN through the firewall?

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/threat-prevention/dns-security/enable-dns-...