Management interface connection to sucuri.net

[adminglu]

Hello,

The management interface from our PA-3260 suddenly tries to connect to 192.124.249.36 on port 80 web-browsing. 192.124.249.36 seems to be part of a CDN registered to Sucuri.net. Is this expected behavior, what service is this for?

[aleksandar.astardzhiev · Accepted solution]

Hi @adminglu ,

Looking at Reverse IP lookup for 192.124.249.36 - SecurityTrails

it looks like this is a CRL/OCSP URL for GoDaddy.

It is expected firewall to make connections to public CRL and OCSP URLs to validate the status of public certificates. I can think of few reason from top of my head:

- Lots of Palo Alto cloud services are using GoDaddy certificates, like update servers, telemetry servers (for AIOps), Data Lake logging

- Decryption rule (no matter if decrypt or no-decrypt) applying decryption profile, which block connection when server cert is revoked.

- Syslog Server using syslog over TLS.

[adminglu]

Thank you for your response. One thing that might be related is that we recently installed a device certificate from Palo Alto following their recent advisory: https://live.paloaltonetworks.com/t5/customer-advisories/emergency-update-required-pan-os-root-and-d...