dns-signature cloud service connection refused.

[Steve_Dussault]

Greetings:

I am seeing in the System Log the following message "dns-signature cloud service connection refused"  Checking the traffic logs the management IP address is not being blocked.  Where do I look to resolve this error message?   Thank you.

[MP18]

@Steve_Dussault 

This also happens if connection to cloud is refused.

Make sure Firewall management interface has connection to cloud 

Try this command

show dns-proxy dns-signature info

Regards

[Steve_Dussault]

MP18:

Here is the results of the command.  The firewall has Internet access but for some reason cannot connect to the cloud service?

 show dns-proxy dns-signature info

Cloud URL: dns.service.paloaltonetworks.com:443

Last Result: Timeout was reached ( 11 sec ago )

Last Server Address:

Parameter Exchange: Interval 1800 sec

Whitelist Refresh: Interval 86400 sec ( Due 83823 sec )

Request Waiting Transmission: 0

Request Pending Response: 0

Cache Size: 8

 ping host dns.service.paloaltonetworks.com
PING dns.service.paloaltonetworks.com (130.211.8.196) 56(84) bytes of data.
^C
--- dns.service.paloaltonetworks.com ping statistics ---
12 packets transmitted, 0 received, 100% packet loss, time 11013ms

ping host updates.paloaltonetworks.com
PING updates.gcp.gslb.paloaltonetworks.com (34.96.84.34) 56(84) bytes of data.
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=1 ttl=113 time=231 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=3 ttl=113 time=229 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=4 ttl=113 time=227 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=5 ttl=113 time=228 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=8 ttl=113 time=228 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=9 ttl=113 time=231 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=10 ttl=113 time=228 ms

[Steve_Dussault]

show dns-proxy dns-signature info

Cloud URL: dns.service.paloaltonetworks.com:443

Last Result: Timeout was reached ( 11 sec ago )

Last Server Address:

Parameter Exchange: Interval 1800 sec

Whitelist Refresh: Interval 86400 sec ( Due 83823 sec )

Request Waiting Transmission: 0

Request Pending Response: 0

Cache Size: 8

 ping host dns.service.paloaltonetworks.com
PING dns.service.paloaltonetworks.com (130.211.8.196) 56(84) bytes of data.
^C
--- dns.service.paloaltonetworks.com ping statistics ---
12 packets transmitted, 0 received, 100% packet loss, time 11013ms

ping host updates.paloaltonetworks.com
PING updates.gcp.gslb.paloaltonetworks.com (34.96.84.34) 56(84) bytes of data.
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=1 ttl=113 time=231 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=3 ttl=113 time=229 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=4 ttl=113 time=227 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=5 ttl=113 time=228 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=8 ttl=113 time=228 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=9 ttl=113 time=231 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=10 ttl=113 time=228 ms

[Steve_Dussault]

MP:

Here is the output of the command.  The firewall does have Internet access and can resolve DNS queries.

show dns-proxy dns-signature info

Cloud URL: dns.service.paloaltonetworks.com:443

Last Result: Timeout was reached ( 11 sec ago )

Last Server Address:

Parameter Exchange: Interval 1800 sec

Whitelist Refresh: Interval 86400 sec ( Due 83823 sec )

Request Waiting Transmission: 0

Request Pending Response: 0

Cache Size: 8

 ping host dns.service.paloaltonetworks.com
PING dns.service.paloaltonetworks.com (130.211.8.196) 56(84) bytes of data.
^C
--- dns.service.paloaltonetworks.com ping statistics ---
12 packets transmitted, 0 received, 100% packet loss, time 11013ms

ping host updates.paloaltonetworks.com
PING updates.gcp.gslb.paloaltonetworks.com (34.96.84.34) 56(84) bytes of data.
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=1 ttl=113 time=231 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=3 ttl=113 time=229 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=4 ttl=113 time=227 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=5 ttl=113 time=228 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=8 ttl=113 time=228 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=9 ttl=113 time=231 ms
64 bytes from 34.84.96.34.bc.googleusercontent.com (34.96.84.34): icmp_seq=10 ttl=113 time=228 ms

[Hammer88]

I have the identical issue, have you been able to resolve it?

[Steve_Dussault]

I worked with TAC and we were not able to resolve the issue.  The firewall is located in China so we believe the issue had to do with "The Firewall of China".  The issue since has resolved itself.

[Hammer88]

I'll open a TAC case also since the Timeout enhancement has not helped.

Tnx!

[JureKosmrlj]

It seems you have to enable paloalto-dns-security app.