download PAN-DB Error

[Satish]

Dear Friends, I am try to download PAN-DB for URL but i am getting below error. please suggest. PAN-DB list Loading Failed (ERROR: SSL Connect Error)

[Satish]

[bdeschut]

Try looking at some log files to get a clue to what's going wrong via the CLI:

for example: tail follow yes mp-log ms.log

Kind regards,

Bob

[HULK]

Hello Satish,

Do you have an internet connection directly from the management interface or you are using service route.?

Please apply CLY command while trying to download the database, and share the putput.

> tail follow yes mp-log ms.log

Thanks

[Satish]

Dear Hulk, No, i am using service route. and device is vwire Mode. i am able to update PAN os, Antivirus... etc but problem is only for URL DB. other Point is that i am also not find any url log in monitor tab. Regards Satish

[ssharma]

Hi Satish,

Are you using Management interface or Dataplane interface to get the get the update. This is configured under Device -> Setup -> Services -> Service Route configuration. From system logs it seems issue is with the ssl connection. There can be many variables causing the ssl failures.

If you are using dataplane interface (external interface) to get the update, do you have deny any any rule. Also, could you please change your interfaces under Service Route Configuration for URL Updates. (For ex if you are using default, use external or internal interface) and Commit. Hope this helps.

[Satish]

Dear ssharma, I am using Management interface for update. and no any deny rule. Thanks Regard satish

[ssharma]

Hi Satish,

Can you change it to inside or trust interface and do a commit. And notice if you still get the same error? Thank you

[HULK]

Hello Satish,

Since you have a service route to reach update server through data-plane interface, make sure "Palo Alto Updates" are set to physical interface ( data-plane).

Thanks

[Satish]

Hi Ssharma, I am using Vwire mode and Mg port have internet access. Thnks

[HULK]

Hello Satish,

It will be better to have the ms.log to understand the point of failutre.

Could you please update CLI output here. > tail follow yes mp-log ms.log 

Thanks

[Satish]

Hi Hulk bro.., but i am able to update for PAN os same config but only problm in PAN-URL.please clear me ur concept. Thanks

[ssharma]

Oh ok....do you have any other firewall or device in the path that might be blocking the traffic. In that case, we will need to sniff the traffic when its leaving the firewall's mgmt ip and see why ssl connection to pandb is not successful (look for fin, rst and see where it is coming from).

[Satish]

Hi Hulk Bro. Oky, let me check and what about logs.

[Satish]

If I put The PAN firewall After sonicwall i am geting all trafic but when i have put the firewall before Firewall any not geting traffic and i have configure 2 trust zone and 2 untrust zone and rule any any allow and profile alert. plz suggest.