Palo Alto Updates Detected as a Threat

[DennyChanditya]

Hello all,

im using content update app and threat 8628-7631 and antivirus 4233-4746 on this day.

is there any url database update on  app and threat 8628-7631 and antivirus 4233-4746?

i have a problem on firewall palo alto, that firewall detected palo alto updates as a threat. the management traffic is traverse the firewall.

i have policy to allow the paloalto updates app. when i check the log it show palo alto updates detected as a threat

i check using command show dns-proxy dns-signature info and shows SSL Connect Error

i take a sample log on updates to wildfire, thereis no threat vault information

After i whitelist the url *.paloaltonetworks.com, im getting Good Result, but sometimes the updates still detected as a threat in traffic log.

second option is, the traffic from management to the palo alto updates i change the security profile to alert only(before it was strict)

Thanks,

Denny

[aleksandar.astardzhiev]

Hey @DennyChanditya ,

What threat log you see for the above corresponding traffic logs?

[OtakarKlier]

Hello,

Its best practice to not inspect the palo alto updates with any service including ssl decryption.

Regards,

[DennyChanditya]

after some troubleshooting, there is no log on threat log, i see on url filtering that show category not-resolved that the action is block.

first i see the connection from firewall management to palo alto cloud is disconnect. so firewall cant identify the app traffic from internal to extenal since the connection is broke. so the firewall make all the traffic into category not-resolved with the block action, the internal traffic is getting block to external.

i have whitelist *.paloaltonetworks.com in url category , then make policy with alert security profile/remote this security profile from the policy than it will works.

still dont know why the connection from firewall to palo alto cloud is broke, but i assume that theres was a issue with the dns.

[DennyChanditya]

Thanks otakar, i didn't about this best practice.

for some reason our users dont want a policy that dont have any security profile, but in this case i attach the security profile but with alert only. we dont use the ssl decryption on the firewall.