Palo Alto Unable to Download Software Updates

[IMTechSupport]

Hi All,

Any advice on a possible solution or workaround? All traffic passes through the proxy server. We have already checked the KB below; however, we cannot change the DNS settings because the proxy server is being used as the DNS server.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEpCAK

Model: PA - 3410

Software Version: 11.1.10-h1

Issue: Can't Download Dynamic Update to the current setup 

Temporary solution: Manual Dynamic Update using CSP.  

Current Setup:

Palo Alto Networks (Management Port) → Proxy Server → (Trust Port) PA → (Untrust Port) → Internet

[Raido_Rattameister]

How is DNS involved in your issue?

Does proxy perform SSL decryption?

Does proxy require authentication?

[IMTechSupport]

Reviewing the traffic logs, where we can find verbose system logs on why palo alto sent rst for update session when download is triggered?

GUI system shows connection is successful.

[IMTechSupport]

-How is DNS involved in the issue?

[GS] DNS resolution on proxy. 

-Does the proxy require authentication?

[GS] No authentication required to proxy.

[Raido_Rattameister]

Error states that certificate validation fails.

Most likely DNS works and paloaltonetworks.com FQDNs get resolved but proxy performs ssl decryption and connection fails due Palo not trusting proxy certificate.

Can you bypass Palo mgmt IP accessing *.paloaltonetworks.com from decryption?

[IMTechSupport]

We are not using the decryption. 

[Raido_Rattameister]

Error clearly points to certificate validation issue.

So re-check proxy config if it is altering certificate.