Device deployment from Panorama

[RobertShawver]

Panorama > Device Deployment > Dynamic Updates > Applications and Threats

Not all of my devices are showing up? If I choose install for the "contents" they all show (current or older versions), but not if I choose install for "Apps".

All versions of GP, AV and WF appear to be normal.

Any idea on where to begin to troubleshoot?

[PavelK]

Thank you for posting question @RobertShawver

Only to confirm, are you referring to setting under Panorama > Device Deployment > Dynamic Updates > Schedules > Add > Type: App, Download and Install?

I just had a look into my Panorama instance and I can see only Firewalls that do not have Threat License when I select Type: App. When I change type to App and Threat, I can see Firewalls with Threat License.

Could you confirm license status of Firewalls that are showing up when you select Type: App? If Panorama is not updated with License status of managed Firewalls you can refresh license status from:  Panorama > Device Deployment > Licenses > Refresh. Ultimately, if managed Firewall is properly registered in Panorama and licensed, you should be able to see it under Device Deployment.

Kind Regards

Pavel

[RobertShawver · Accepted solution]

Hi @PavelK -

Thank you for the reply.

No, what you referred to was scheduling. "Only to confirm, are you referring to setting under Panorama > Device Deployment > Dynamic Updates > Schedules > Add > Type: App, Download and Install?"

What I'm aiming for is more on the fly, "Panorama > Device Deployment > Dynamic Updates > Applications and Threats".  From there click "Check Now" and then download on the version you want and then click "install" after it's downloaded.

Although I don't think there is anything wrong.  Palo Alto, gives you the ability to separate Apps from Threats on the Panorama (Apps - only) but also combines them (Contents - Apps and Threats) for Device Deployment.  They are combined on the local firewall.

 

[PavelK]

Thank you for quick reply and clarification @RobertShawver

I now understand what you mean. I just had a look and I can see the same thing. When I click on Install "Apps", only Firewalls that do not have Threat Prevention license are showing up in the list. When I click on "Contents", I can see in the list, all Firewalls with Threat Prevention license. I think this is expected. Firewalls that do not have Threat Prevention license can't install any signatures, therefore are only listed under "Apps". If you are seeing Firewall to show up in wrong list, could you try to refresh license from Panorama.

Kind Regards

Pavel

[RobertShawver]

I appreciate your time looking at this for me.  I don't think I would have figured it out without your initial post.  I didn't even know the scheduling was a thing.  LOL.  Once I started to look and think about it it, it all made sense.