PAN DB CLOUD DISCONNECTED | Cloud is not ready, there was no update from the cloud

[Jack_Howells]

Hi guys,

Seeing an error message show up in the System logs:

"Cloud is not ready, There was no update from the cloud in the last 630 minutes. 04/18 09:49:25"

I have connectivity to updates.paloaltonetworks.com, as the Palo is able to retrieve licenses and any updates, such as dynamic updates, and I am able to 'Check now' in the Software updates tab. 

If I run 'tail follow yes mp-log ms.log' whilst checking for software updates I can see I'm successfully connecting to the update server.

"https://updates.paloaltonetworks.com/Updates/UpdateService2.asmx/CheckForSoftwareUpdate
Resolving updates.paloaltonetworks.com... 199.167.52.141
Connecting to updates.paloaltonetworks.com|199.167.52.141|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 71877 (70K) [text/xml]
Saving to: `/opt/pancfg/mgmt/global/upgradeinfo.xml.10009.tmp'

0K . 100% 245K=0.3s

2016-04-18 11:13:35 (245 KB/s) - `/opt/pancfg/mgmt/global/upgradeinfo.xml.10009.tmp' saved [71877/71877]

2016-04-18 11:13:36.782 +0100 No upload information available
2016-04-18 11:13:36.792 +0100 Error: pan_mgmt_get_sysd_string(pan_cfg_status_handler.c:367): failed to fetch cfg.platform.uuid
2016-04-18 11:13:37.417 +0100 No upload information available
2016-04-18 11:13:37.427 +0100 Error: pan_mgmt_get_sysd_string(pan_cfg_status_handler.c:367): failed to fetch cfg.platform.uuid"
 

I don't think there is much of an issue here, as I can reach the update server, but is it trying to reach something else? What could it be? Not much information on this elsewhere, so I'd like this to be online so people with the same issue can at least find something!

Thanks

Jack

[Jack_Howells]

 Turns out it's the PAN-DB's cloud that's causing the issue.

show url-cloud status

PAN-DB URL Filtering

License :                          valid

Cloud connection :                 not connected

URL database version - device :    2016.01.20.470

URL protocol version - device :    pan/0.0.2

admin@CNN054974(active)> test url facebook.com

facebook.com social-networking (Base db) expires in 0 seconds

facebook.com cloud-unavailable (Cloud db)

admin@CNN054974(active)> ping source x.x.x.x host s0000.urlcloud.paloaltonetworks.com

PING s0000.urlcloud.paloaltonetworks.com (46.51.252.65) from x.x.x.x : 56(84) bytes of data.

64 bytes from s0501.urlcloud.paloaltonetworks.com (46.51.252.65): icmp_seq=1 ttl=40 time=233 ms

64 bytes from s0501.urlcloud.paloaltonetworks.com (46.51.252.65): icmp_seq=2 ttl=40 time=233 ms

64 bytes from s0501.urlcloud.paloaltonetworks.com (46.51.252.65): icmp_seq=3 ttl=40 time=233 ms

64 bytes from s0501.urlcloud.paloaltonetworks.com (46.51.252.65): icmp_seq=4 ttl=40 time=233 ms

64 bytes from s0501.urlcloud.paloaltonetworks.com (46.51.252.65): icmp_seq=5 ttl=40 time=233 ms

If I can ping the cloud, but my box is disconnected, what can cause this?

Appreciate the help with this.

Thanks

Jack

[bpappas]

Assuming that you have ruled out local network issues and have validated that the Palo Alto Networks device appears to be in good health I would suggest opening a support case.

Our team can help isolate the issue and find a solution and/or workarounds to keep your environment safe and stable.

Thanks,

Benjamin

[Jack_Howells]

Just querying to see if anyone has come across this before. This is currently a support case I am working on, but hoped someone with a similar issue would be able to comment.

I will be diagnosing this further tomorrow and will update the post if I find a solution. In the meantime, feel free to add your thoughts if you're currently reading this.

[Jack_Howells]

This was a couple of months ago now, but I just wanted to let someone know we resolved this by upgrading to the latest apps and threats version - 550. This exact content version won't resolve future issues now, but it may be a good step to take if the same issue re-appears.

[Alpalo]

Hi,

I have the same problem, Have you resolved it?

REgards

[Craig_Beamish]

[Craig_Beamish]

I came across this today too for update package thats 3 or 4 days old. updating the apps/contents package fixed it.

[LG_sait7kim]

i got url-filtering event "Cloud is not ready, There was no update from the cloud in the last 90 minutes."

[BPry]

@LG_sait7kim,

Seems to be happening again across my fleet of devices across multiple clients located across the United States. Seems to just be an on-going outage on PAN's side of things. 

[LG_sait7kim]

This event is repeating infinitely.

'Cloud is not ready, There was no update from the cloud in the last XX minutes.'

'CURL ERROR: Empty reply from server'
'CURL ERROR: bind failed with errno 97: Address family not supported by protocol'

'PAN-DB cloud list loading failed (ERROR:Couldn\'t resolve host name'

'CURL ERROR: Could not resolve host: s0000.urlcloud.paloaltonetworks.com'

[bmaxisback]

Reddit says it's been resolved via a PAN-DB update. 
Too bad I had to find out in a 3rd party source. 
https://www.reddit.com/r/paloaltonetworks/comments/17vh2wt/curl_error_empty_reply_from_server/

[kaymorrison]

I have one client that hasn't recovered from this issue, what do we need to do to resolve the cloud connectivity issue?