Unable to download updates

[Jafar_Hussain]

Hello,

When i download the PAN-OS or content update getting below error:-

Troubleshooting performed from my side:-

• I can see all the services are running via the management plane.
• I checked the connectivity between the management interface and the internet it was working fine.
• I checked the traceroute from the firewall towards the update server of Paloalto, it was working perfectly.
• Then I put ip address instead of the URL in the update server. But still, the issue persists.
• We tried to download the dynamic updates but the same issue is happening.
• In the last, we restarted the management server.

Can Any one suggest on this what i need to check.

[vsys_remo]

Hi @Jafar_Hussain 

How did you check the connectivity between the mgmt interface and the internet? Is the connection traversing another firewall where may be tls decryption is enabled? Did this suddenly stop working or was it never working? Do you have a dns server configured? If there is another firewall or even the same make sure the traffic is allowed and either tls decryption disabled or then the checkbox at "check update server identity".

[Jafar_Hussain]

@vsys_remoPlease find the answer below:-

How did you check the connectivity between the mgmt interface and the internet?- I can able to ping google.com and 8.8.8.8 through management interface.

Is the connection traversing another firewall where may be tls decryption is enabled? - No decryption policy is configured.

Did this suddenly stop working or was it never working? - I think, the last content update downloaded before 8 months.

Do you have a dns server configured?- Yes

If there is another firewall or even the same make sure the traffic is allowed and either tls decryption disabled or then the checkbox at "check update server identity". - Checkbox is checked in verify server identity.

[MP18]

@Jafar_Hussain 

As per your info seems all is configured correctly.

This type of error normally comes if any firewall in path is doing ssl decryption and on this PA verify update server identity is checked.

1>>Can you please verify what you have configured under update server?

See if you can ping updates.paloaltonetworks.com

2>>Also if you verify and test number 1 then only thing i can say is uncheck the verify server identity

Regards

MAhesh

[reaper]

as mentioned above, have you checked if URL filtering is maybe blocking (or presenting a 'continue') your dynamic updates

this one may sound silly, but have you tried hitting the 'check now'

last resort (try the silly one first)

debug swm rebuild-content-db

[Jafar_Hussain · Accepted solution]

@MP18 

Thank you.

Once i uncheck the verify server identity and delete previous PAN-OS version after that i can able to download software.