System Alert:Failure to check wildfire content upgrade

[awarsame]

In last two days, I started getting system alerts that says "SYSTEM ALERT : high : Failed to check WildFire content upgrade info due to generic communication error" and another that says "SYSTEM ALERT : high : HA Group 1: Anti-Virus version does not match" from PA-3020 HA pairs. the HA alerts comes always at 1:31am.  The system's health seems ok and auto updating  regularly from PA.

I am new to PA firewalls so I would appreciate any body can tell me what may be the issue.

thank you

[ExclusiveNetworksGermany]

I would guess that you have configured an automatic update Scheduler for 1:30 am (or may be a little bit earlier)

Depending on your configuration the Master is updated first and then the Update is pushed to the slave

So depending on how long it would take to commit the AV Update there may be a small time frame

where you have a mismatch in AV Versions.

Cheers

Marco

[kprakash]

Hi awarsame,

From what I understand, the PANFW cannot connect to the wildfire server, and thats why we get the "Failed to check WildFire content upgrade info due to generic communication error". Can you change the update server to "staticupdates.paloaltonetworks.com" to see if it makes a difference. ( device tab--> setup--->services )

With regard to the Anti-Virus version does not match issue, verify if the HA pairs havent been configured to download and/or install the version at the same time. The recommended steps is to keep at least a 30 minute time difference, for the download and/or install 30 mins,between both the firewalls. Also verify that the "Enable config Syn" check box is clicked under the HA settings ( device----> high-availability-----> general)

You can also use the command:

request high-availability sync-to-remote running-config

BR,

Karthik

[mschuricht]

I have seen these errors in the past when there are DNS resolution issues.

Is the DNS server that is in Device > Setup > Services working correctly?

Can you ping a FQDN and have the DNS resolve an IP?

[awarsame]

It can resolve FQDN for UPDATES.PALOALTONETWORKS.COM (199.167.52.13) and STATICUPDATES.PALOALTONETWORKS.COM (199.167.52.15).

I tried both of these update servers and I am still getting the wildfire upgrade failure errors.  it is not all the time. it succeeds after multiple tries.

[mschuricht · Accepted solution]

Please open a case with support for further investigation.