Configuration for update server when static update server is used in Firewall

Background:

• Dynamic Content Updates A subscription service delivers timely updates that offer comprehensive protection across the threat landscape, safeguarding you from legacy and evolving threats. 
• By default, the content update URL is provided under Device-> setup -> services-> update server has a fixed URL  "updates.paloaltonetworks.com".  The URL will resolve to different IP addresses as the update servers are located across different geographical locations for faster content delivery.

Summary of the Objective: Download the dynamic content from a fixed address

• Update Server configuration must be hostname-based. Connecting via IP address circumvents SSL/TLS certificate validation, rendering the connection vulnerable to MITM attacks.
• The article provides configuration guidelines for any Firewall or Panorama to use configuration under setup->service->update server. "staticupdates.paloaltonetworks.com"

NOTE: These changes are effective immediately.

• Any PAN-OS.
• Threat protection license.
• Any Firewall.

1. For the Firewalls or appliances that connect from outside mainland China and want to continue using the dynamic content server, use the  URL "updates.paloaltonetworks.com" 

 

2. On the Firewalls or appliances that connect from mainland China, modify the URL from "staticupdates.paloaltonetworks.com" to "updates.paloaltonetworks.cn"

3. On the Firewalls or appliances that have access to outbound traffic restricted by IP, Use the URL  “us-static.updates.paloaltonetworks.com".

NOTE: Avoid using an IP address instead of a URL. Doing so will break the SSL/TLS SNI verification.

4. If the Firewall needs to connect to the static update server using outbound Security Policy to limit the IP addresses available for updates, then implement the following change.

5.  If any connection issues are found, try the following:

• Continue utilizing  "staticupdates.paloaltonetworks.com" until July 31st, 2021 as we will support this server for an easy transition. 
• Allow IP address 199.167.52.15. 
• Open a support case

• Install Content Updates document describes how to install content updates in detail. 
• Content Delivery Network Infrastructure IP/FQDNs (including Static IP's)
• Steps are illustrated in the flow diagram below to help make correct choices. 

> set cli config-output-format set
> configure
# set deviceconfig system update-server <update-server-name>
# commit
# exit