PAN-DB cloud list loading failed (ERROR:SSL connect error

[S.Ramesh960545]

The active firewall is connected while the passive is not connected. In that case sometimes we getting, 

PAN-DB cloud list loading failed (ERROR:SSL connect error

I believe we can ignore this error message if it's getting the error once in awhile since it could be failed due to SSL connectivity error to Palo Alto update server.

The concern is it because of passive firewall is not connected ?

[mshekh]

Hi @S.Ramesh960545 ,

IF passive device management interface doesn't have internet access then you will see this message, however if you have internet connection via management interface then you have to check in path if there is anything blocking the traffic.

[S.Ramesh960545]

Hi, are you talking about the error log message or for the 

> show url cloud status, output

[mshekh]

Hi @S.Ramesh960545 ,

Both error logs and show url-cloud status output, what status do you see with running the command show url cloud status and do you see any error in system logs.

[S.Ramesh960545]

The system log error PAN-DB cloud list loading failed (ERROR:SSL connect error 

can only be seen in active firewall.

> show url cloud status (active)

PAN-DB URL Filtering
License :                          valid                                   
libcurl resolver :                 threaded                                
Current cloud server :             serverlist.urlcloud.paloaltonetworks.com
Cloud connection :                 connected                               
Cloud mode :                       public                                  
URL database version - device :    20250203.20043                          
URL database version - cloud :     20250203.20043  ( last update time 2025/02/03 10:30:54 )
URL database status :              good                                    
URL protocol version - device :    pan/2.0.0                               
URL protocol version - cloud :     pan/2.0.0                               
Protocol compatibility status :    compatible            

> show url cloud status (passive)

[mshekh]

Hi @S.Ramesh960545 ,

Thanks for sharing the output as currently passive device is not connected to cloud due to that you are getting the error. 

Looks like passive device doesn't have internet access via management interface due to that you are seeing the error..

You may check with failover traffic to passive device as if you are using data interface in service route to connect internet then it's expected..

[PavelK]

Hello @S.Ramesh960545

could you have a look into below KBs:

HA passive device keeps making failed PAN-DB cloud connection

Why Does the PAN-DB Version Not Update on the Passive Firewall?

Kind Regards

Pavel