Download PAN-OS from GUI failing, potential MTU Problem ...

[nawaza]

Ok folks

Here's an interesting one for you.

This is to do with connectivity between Panorama and updates.paloaltonetworks.com

We can retrieve licence info and download list of updates available for downloads (SW and Threats), but when clicking on download link the connection fails with standard connectivity to updates.palo error, try again later.

This is long shot, but has anyone seen this before?

PAN-OS 8.0.2 VM base image, intending to upgrade to 8.0.7 if the download worked 😕

Ajaz Nawaz

JNCIE-SEC No.254

CCIE-RS No.15721

[reaper]

Have you tried re-running 'check now' ?

Have you followed the connection through a firewall (packetcapture + global counters) to see what may be happiening, have you seen MTU error messages?

MTU issues can be fixed by changing the MTU and/or setting TCP MSS rewrites, but you'll want to investigate the connection to see what is actually happening before changing these settings

[nawaza]

hmmm..

So its nothing to do with MTU after all.

Currently investigating but updates.paloaltonetworks.com is resolving to :

a92-122-165-117.deploy.akamaitechnologies.com.https

But... in front of Panorama there is a perimeter SRX fw allowing updates.paloaltonetworks.com ONLY !

admin@asfdsadfasdf> view-pcap mgmt-pcap mgmt.pcap

17:22:58.515102 IP <ip-addr-removed>.36347 > a92-122-165-117.deploy.akamaitechnologies.com.https: S 1831023988:1831023988(0) win 14600 <mss 1460,sackOK,timestamp 2046968 0,nop,wscale 7>
17:22:59.192528 IP fl-7034162.sc.reg.net.51362 > <ip-addr-removed>.https: P 17867:18679(812) ack 17555 win 256
17:22:59.192544 IP <ip-addr-removed>.https > fl-7034162.sc.reg.net.51362: . ack 18679 win 330

So it seems we need to introduce another policy on SRXs but they are native fw's not next-gen, so dynamic policy is not an option.

Stay tuned !

Ajaz

[nawaza · Accepted solution]

Ok so Palo use CDN (Content Delivery Network e.g Akamai), to deliver dynamic updates and downloads. If your network does not allow for the 'Dynamic' nature of CDN in terms of DNS, then modify your update server from:

updates.paloaltonetworks.com

TO

staticupdates.paloaltonetworks.com

Or.. architect your network to tolerate and act upon dynamic DNS

Also please take look at this for further details:

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/threat-prevention/content-delivery-n...

Hope this helps !

Ajaz