Panorama - dynamic updates not working

[raji_toor]

Software Version 8.0.9

Application Version 8024-474 

Panorama VM is not receiving dynamic updates. I have checked traffic is allowed and also license is not expired.

On manual check it is getting this error.

Also tried updating by directly uploading the file. Apps+Threats file uploaded but gave error below.

Apps file uploaded and it was able to get installed. But i think now Panorama does not have any Threat information.

[gwesson]

For the communication error, the simplest reason is usually that DNS hasn't been set up (or is not reachable). From Panorama's CLI, see if you can get the IP from the ping command. Note that you won't get a response from ping, but you should see the IP resolve:

> ping host updates.paloaltonetworks.com
PING updates.inap.gslb.paloaltonetworks.com (199.167.52.141) 56(84) bytes of data.
^C
--- updates.inap.gslb.paloaltonetworks.com ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 2999ms

As for the manual upload, you can't upload the App+Threat to Panorama since it has no concept of threats for itself. You would need just the App package ("panupv2-all-apps") if you're uploading to it manually.

[raji_toor]

@gwesson  DNS is setup but as you said PA IP does not respond.

Panorama> ping host updates.paloaltonetworks.com
PING updates.inap.gslb.paloaltonetworks.com (199.167.52.141) 56(84) bytes of data.
^C
--- updates.inap.gslb.paloaltonetworks.com ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3004ms

[gwesson]

Good deal. 

You blocked out the source IP address, so hopefully it's a NAT address. If you're not doing source NAT, then you'll need to do that as well so the responses can be routed back to your Panorama management IP. If the NAT is good, your best bet may be to open a support case. 

[raji_toor]

TAC case it will be then. Thanks.