PCNSE · Question #284
An administrator needs to upgrade an NGFW to the most current version of PAN-OS?software. The following is occurring: - Firewall has internet connectivity through e 1/1. - Default security rules and…
The correct answer is D. DNS settings for the firewall to use for resolution. The scenario already provides internet connectivity, a service route, and security rules allowing SSL/web-browsing traffic, yet a 'communication error' appears in System logs and the download fails. This classic symptom points to DNS resolution failure: the firewall cannot…
Question
An administrator needs to upgrade an NGFW to the most current version of PAN-OS?software. The following is occurring:
- Firewall has internet connectivity through e 1/1.
- Default security rules and security rules allowing all SSL and web-
browsing traffic to and from any zone.
- Service route is configured, sourcing update traffic from e1/1.
- A communication error appears in the System logs when updates are
performed.
- Download does not complete.
What must be configured to enable the firewall to download the current version of PAN-OS software?
Options
- AStatic route pointing application PaloAlto-updates to the update servers
- BSecurity policy rule allowing PaloAlto-updates as the application
- CScheduler for timed downloads of PAN-OS software
- DDNS settings for the firewall to use for resolution
How the community answered
(49 responses)- A6% (3)
- B10% (5)
- C2% (1)
- D82% (40)
Explanation
The scenario already provides internet connectivity, a service route, and security rules allowing SSL/web-browsing traffic, yet a 'communication error' appears in System logs and the download fails. This classic symptom points to DNS resolution failure: the firewall cannot resolve the hostnames of Palo Alto Networks update servers (updates.paloaltonetworks.com, etc.) because no DNS server is configured. Configuring DNS under Device > Setup > Services resolves the hostnames, allowing the download to succeed. A static route, scheduler, or application-specific rule would not fix a name-resolution problem.
Topics
Community Discussion
No community discussion yet for this question.