download PAN-DB Error

[Satish]

Dear Friends, I am try to download PAN-DB for URL but i am getting below error. please suggest. PAN-DB list Loading Failed (ERROR: SSL Connect Error)

[HULK]

Just FYI.

Once you will try to download any update, there will be 2 separate connections established to complete it successfully. 1st, it will try to reach the license server to verify the license information for the device S/N. Upon successful completion, it will try to establish an another SSL connection to a CDN network ( Public IP starts with 192.x.x.x.x) to download the actual database.

So, we need to make sure SSL is allowed throughout the path. Pls verify if any SSL packet with destination prefix (192 or 191 ) is getting dropped at sonicwall.

Thanks

[Satish]

Oky Bro.., Let me check and come back to you. Thanks Regards Satish

[jperry1]

Satish

You can sniff the traffic in your management interface by using the following commands

> tchdump <--- let this command run for 10-15 seconds after trying to manually update

>  view-pcap mgmt-pcap mgmt.pcap mgmt.pcap <--- it will show you the PCAP output for the management interface

> view-pcap verbose++ yes mgmt-pcap mgmt.pcap  <-- will give you more detailed output

It sounds as if something may be blocking that traffic on the sonicwall but we won't know until more detail.

Do you see any log output on the Sonicwall saying it is blocking an item?

[Satish]

Dear Jperry, Thanks for your reply. i will do this tomorrow and come back to hare. Thanks Regards Satish

[prb]

Something up with SSL connectivity. Logs should give a clue.

Perhaps you can open a support ticket for quicker resolution?

[Satish]

Hi All, Till i am facing issue no traffic block bye Sonicwall, I am able to telnet port 443. any idea friends. Regards Satish

[HULK]

Hello Satish,

Could you please share the ms.log output.

Thanks

[Satish]

[HULK]

Hello Satish,

I hope this is a VM machine, where you are trying to download the PAN-DB database. Could you please check if "Verify update Server Identity" option is checked on this VM. This option is available under Device > Setup > Service. If yes, please uncheck that option and try once again. ( a commit required).

Thanks

[Satish]

Hii.., No bro.. You are wrong. there no VM. i am using PA-3020. Regards Satish

[jperry1]

Satish

Open the CLI and run the following command

delete license key ?

It will then display all of your licenses. Find the license key for PANDB and it should look something like

PAN_DB_URL_Filtering_2014_05_24_**********.key

Once you find the key for PANDB delete them and then run

request license info

to make sure it has been removed.

Then go back to the GUI and retrieve your licenses or manually add the PANDB auth code.

Let me know if this works. Thanks Satish.

[Satish]

HI jperry, Thanks for your reply. let me check and i will back. Regards Satish

[Satish]

Dear Jperry, i have tried the same but i am facing same issue. Regards Satish

[kfindlen · Accepted solution]

Is your upstream Sonicwall performing SSL decryption?  The connection between the firewall and the PAN-DB servers is not compatible with SSL decryption.

[Satish]

Thanks all for quick response. after the long R&D we are find out issue with sonicwall firewall. when i have put the direct ISP ip in Mgt port its working fine. but its happen only some case. Thanks a lot for your reply ones again. Regards Satish