About nextgenhappines

Hi,   I ran into the same issue about 2 months ago.  I restarted the userid process on one of my UserID box and that addressed the issue, that pair was using content update older than 8507.    After that I upgraded all the UserID redist firewall newer content (>8507),  I don't have that same issue again.     Can you check if the firewall content release version is newer than 8507?   (12/21/2021; updated 1/13/2022) A certificate used by PAN-OS software to authenticate to the WildFire Private Cloud appliance (WF-500) and URL Filtering Private Cloud appliances (M-500 and M-600 in Private URL Filtering Cloud mode) and that impacts User-ID redistribution expired on December 31, 2021. We released Emergency Content release version 8507 on December 21, 2021, to update this certificate so that PAN-OS appliances can authenticate to these private cloud appliances. Immediate action is required for all of your PAN-OS appliances that use either the WF-500 WildFire Private Cloud appliance or the M-500 or M600 appliances in Private URL Filtering Cloud mode. UPDATE: User-ID redistribution is also impacted and requires that you complete additional steps before you are able to utilize the renewed certificate. If you have not already done so, you must update your appliances to Content release version 8507 or a later version to ensure that these appliances (including hardware firewalls, VM-Series virtual firewalls, and CN-Series container firewalls) will continue or again connect to WF-500 and URL Filtering private cloud appliances. Please refer to the customer advisory for detailed information about utilizing your renewed certificate.   ... View more

Hi Kiwi,   Case already opened, these are the reply from TAC   TAC responds #1   Thanks for the update, Since you mentioned the certificate expired. you can try using other methods to connect your firewall to the update servers. Here are few ways you can use to connect to Palo Alto update servers You can use other servers like: updates.paloaltonetworks.com  proditpdownloads.paloaltonetworks.com  => newer site hosting dynamic content on ssl port 443.  downloads.paloaltonetworks.com 1.) HOW TO MANUALLY INSTALL ANTIVIRUS, CONTENT, AND WILDFIRE UPDATES ON THE FIREWALL: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFhCAK Please let me know if this helps you.    TAC Respond 2   Thanks for the update, As you provide the KB which you followed states you can use the 1 procedure.  Procedure Following are configuration steps based on the location of the Firewall/Panorama or internal access restrictions.    1. For the Firewalls or appliances that connect from outside mainland China and want to continue using the dynamic content server, use the  URL "updates.paloaltonetworks.com Since the current certificate is expired you can try this other procedure and still be connected to update serves. So please let me know if you can test this procedure.    Feel free DM me if you want the case number... ... View more