MineMeld URL Access Error

[Ash2k]

I have setup MineMeld on a VM and it seems to be working correctly but, when I setup the EDBL on a PAN firewall and test it, I get a "URL access error" message on the firewall. I can access the feed if I put the URL into a browser and can see the list of addresses.

I get the same error whether using the IP or FQDN as the Source. I've even gone as far as configuring MineMeld with our 3rd-party wildcard certificate in case the self-signed certificate was causing the issue, but this hasn't helped.

Any advice would be appriciated.

[Ash2k · Accepted solution]

Looks like the issue was caused by our Palo Alto Updates service route set to the external interface and the MineMeld URL being internally accessible only. Changed the serrvice route to default and then the EDBLSource was accessible.

https://live.paloaltonetworks.com/t5/Management-Articles/Dynamic-Block-Lists-DBL-not-working-Service...

[lmori]

Hi @Ash2k,

I think a possible alternative is using a specific Destination route for the MineMeld IP.

[Ash2k]

Hi Imori,

I did try this at first but got an error when accessing the URL. Have just tested it again with entries for both the IP and FQDN but can only access the URL when the "Palo Alto Updates " service route is set to the internal.

Would have been nice to set a specific destination route and still have Palo Alto Updates going out via the external interface.

Ash

[lmori]

Yes, I will talk to PMs about this.

[Mohamed-Hakim]

When changed service route to default instead of external interface internal IP EDBLSource was accessible but external resolving services didn't work like "dynamic update " . how to fix that

[lmori]

Hi @Mohamed-Hakim,

please, could you share more details about your network layout and configuration ?

Thanks,

luigi

[Flo]

Thank you, the other way would be to deploy MineMeld in the DMZ so it is reachable from Untrust, but I'd rather not do so.

Is there any reason [security?] why our palo alto consultant configured the "Palo Alto Update Service" to use a specific external interface rather than "default" ?

[rohill]

Having an issue with EDL miner output.  I am able to see the IPs associated for the output miner when I click on the URL in mindmeld.  However if I copy and paste that URL I receive an unauthorized error message and when I click test URL on the firewall I get a URL error message.  Any suggestions on correcting this issue.  

Thanks 

[lmori]

Hi @rohill,

the "problem" is that MineMeld on Autofocus by default authenticates accesses to the feeds. You should define credentials to access that feed and associate a tag to it.

More details here: https://live.paloaltonetworks.com/t5/MineMeld-Articles/Connecting-PAN-OS-to-MineMeld-using-External-...

Luigi