Problem with dynamic update Failed to download file

[MarcinKrasz]

Hi,

I have a problem with dynamic updates. I see new content version or antivirus, but I cannot download it with message Failed to download file.

Ping to updates.paloaltonetworks.com and downloads.paloaltonetworks.com is working.Service route is Use managment interface for all.

[Claw4609]

Hello,

If you look at the traffic logs do you see the MGMT interface communicating with WAN traffic fine? Is it getting bytes received on various traffic? I forget the exact app-id but I believe its "paloalto-updates" do you see that application in the traffic logs? 

Would also just select "check now" again on the download page again and then try again. Also verify you have an active threat license on the firewall. 

[MarcinKrasz]

Traffic is ok I see in monitor logs 

Threat and advance license is in place. I make on couple fw workaround I download and install content from Panorama but with new content I still see Failed to download file.

Check now is working 

[OtakarKlier]

Hello,

In addition to what was already suggested, make sure the security policy that the traffic is using does not have any ssl decryption or threat inspections enabled. This will also prevent updated from downloading.

Regards,

[MarcinKrasz]

Resolved. Missed the rule on other fw 

[S.Taganov]

What to do if there is a problem on Panorama: there is an Internet connection, DNS is working correctly, domains (updates.paloaltonetworks.com , edge-enforcer-iot.iot.services-edge.paloaltonetworks.com ) are resolved, the device certificate is valid, and subscriptions are activated. The only device between Panorama and the Internet is the firewall, on which the any-any allow rule is configured.