Download of Brightcloud update failed with the following error
>tail follow yes mp-log pan_bc_download.log
Jul 19 01:55:28 ip 220.127.116.11 message RT time 0.079
Jul 19 01:55:28 ip 18.104.22.168 message RT time 0.120
Jul 19 01:55:35 Best IP for service.brightcloud.com is 22.214.171.124
Jul 19 01:55:37 Connected to Brightcloud update server service.brightcloud.com
Jul 19 01:55:45 Cannot receive data from 'service.brightcloud.com:80' to download BrightCloud URL database
Jul 19 01:55:45 Error downloading latest URL database
Jul 19 08:51:25 Error: dtMessageTime(bcnet.cpp:249): failed connect to 126.96.36.199 on 80
Jul 19 08:51:30 Error: dtMessageTime(bcnet.cpp:249): failed connect to 188.8.131.52 on 80
Jul 19 08:51:35 Error: dtMessageTime(bcnet.cpp:249): failed connect to 184.108.40.206 on 80
Jul 19 08:51:35 Best IP for service.brightcloud.com is 0.0.0.0
Jul 19 08:51:37 Error: Brightcloud update server 'service.brightcloud.com' is down!
Jul 19 08:51:37 Error downloading latest URL database
Running the command show global counters showed that those connections matched a rule for captive portal traffic
Since the firewall can't authenticate to the captive portal, a new captive-portal policy was added to allow the firewall access to the update servers directly, without going through captive portal.