Unable To Connect To MineMeld Output URL Via EDL

[jdemery]

Setup an EDL in Panorama to grab a IPv4 feed from a Minemeld (Autofocus hosted) output.  Verified the EDL was pushed down to one of our PA-5050's and clicked on 'Import Now' from the 5050.  EDL is not able to connect and system log shows following:

"Unable to fetch external dynamic list. HTTP response code said error Using old copy for refresh."

When clicking on 'Test Source URL' a pop-up states "URL access error".

Using curl locally from my desktop I am able to successfully connect to the Minemeld output URL feed with the configured username/password.  Triple checked that credentials in the EDL match that of what is set in the user feed username and that the correct tag is assigned to both the username and Output Node. Also created a username under the Admin Feed and configured the EDL to use those credentials but got the same response.  Changed the tag on the Output Node to 'any' and that also does not work when trying to connect from the 5050.  It seems the only way the 5050 can connect to the URL is if the Output Node is set to 'anonymous' - which we would rather not do. 

Can't seem to find any logs with the AF hosted instance of Minemeld that would show the 5050 attempting to connect.  Any help/ideas are more then appreciated!  Thanks!

[lmori]

Hi @jdemery,

I do agree *anonymous* is not a soluton. You should create a feed user, an access tag and then associate that tag with the feed.

See here:

https://www.paloaltonetworks.com/documentation/autofocus/autofocus/autofocus_admin_guide/autofocus-a...

[jdemery]

Thanks for the feedback...that's actually the instruction set I followed when first setting up the EDL to pull from the Output Node I have setup in MineMeld.  The strange thing is that I if I use curl locally from my desktop (or anywhere) I can connect successfully using the credentials I have setup as a feed user.  Using the same credentials I can not connect from the firewall.  I have triple checked the credentials just to be sure nothing was fat-fingered.

[lmori]

Hi @jdemery,

you can do 2 things:

- check the ms.log file on the firewall to see which error is returned by the EDL download process

- download the API log from MineMeld (System > Dashboard > API > Logs). There you should find the URL requested by the firewall and see if there is a 401 erorr (Unauthorized) or something else

Thanks,

luigi

[jdemery · Accepted solution]

This started working after Panorama was upgraded from 8.0.2 to 8.0.3-h4 and our firewall upgraded from 7.1.9 to 8.0.3-h4.