Palo Alto Updates Detected as a Threat

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Palo Alto Updates Detected as a Threat

L2 Linker

Hello all,

im using content update app and threat 8628-7631 and antivirus 4233-4746 on this day.

is there any url database update on  app and threat 8628-7631 and antivirus 4233-4746?

 

i have a problem on firewall palo alto, that firewall detected palo alto updates as a threat. the management traffic is traverse the firewall.

i have policy to allow the paloalto updates app. when i check the log it show palo alto updates detected as a threat

2.jpeg

i check using command show dns-proxy dns-signature info and shows SSL Connect Error

1.png

i take a sample log on updates to wildfire, thereis no threat vault information

DennyChanditya_1-1665547623985.png

 

After i whitelist the url *.paloaltonetworks.com, im getting Good Result, but sometimes the updates still detected as a threat in traffic log.

DennyChanditya_0-1665546592673.png

 

second option is, the traffic from management to the palo alto updates i change the security profile to alert only(before it was strict)

 

Thanks,

Denny

4 REPLIES 4

Hey @DennyChanditya ,

What threat log you see for the above corresponding traffic logs?

Cyber Elite
Cyber Elite

Hello,

Its best practice to not inspect the palo alto updates with any service including ssl decryption.

 

Regards,

after some troubleshooting, there is no log on threat log, i see on url filtering that show category not-resolved that the action is block.

 

first i see the connection from firewall management to palo alto cloud is disconnect. so firewall cant identify the app traffic from internal to extenal since the connection is broke. so the firewall make all the traffic into category not-resolved with the block action, the internal traffic is getting block to external.

 

i have whitelist *.paloaltonetworks.com in url category , then make policy with alert security profile/remote this security profile from the policy than it will works.

still dont know why the connection from firewall to palo alto cloud is broke, but i assume that theres was a issue with the dns.

 

L2 Linker

Thanks otakar, i didn't about this best practice.

 

for some reason our users dont want a policy that dont have any security profile, but in this case i attach the security profile but with alert only. we dont use the ssl decryption on the firewall.

  • 1868 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!