1. Panorama will not push the bright cloud database to the firewalls. This has to be done on per firewall basis. You can verify the database used by a firewall thorugh: show system setting url-database If the database is not Bright Cloud, you can switch to Bright Cloud through: set system setting url-database brightcloud 2. Can you provide the screenshot of the cert you are trying to generate? Also, when trying to generate a cert in a putty session, can you run the command: tail follow yes mp-log ms.log and attach the output here? 3. Can you ping updates.paloaltonetworks.com from CLI? You get the error when there is connectivity issue.
... View more