The updates.paloaltonetworks.com is a content delivery network which currently resolves to 199.167.52.13. The requests are typically made over port 443(ssl) which include application, threats and antivirus updates. As for the Bright Cloud updates, they are now using dynamic ip addresses. The device will first connect to service.brightcloud.com on port 80 and checks for updates. If there are updates available, it will connect to database.brightcloud.com on 443 to download the database. You can verify the ip addresses for url updates through CLI: > less mp-log pan_bc_download.log For update server: > less mp-log ms.log Hope that helps.
... View more