Upgrade failure

Question

Hi experts,
I am deploying a new WSA, but seem unable to upgrade AsyncOS - when I check for available upgrades, I receive the following error:
Error
Failure downloading upgrade list.
Everything else seems to be OK - I have time via the default NTP servers, checks for new feature keys return a success, policy trace returns what I would expect.
I have noticed that the feature keys the client purchased are listed as Active with 30 days remaining and an expiration date of Dormant.
Does the appliance license need to be activated? I can't seem to locate a Claim Certificate to find the PAK...
Thanks.

Answer 1

Hi,
The status Dormant means that the feature is currently not being used by the Device e.g as the HTTPS Proxy status shows Dormant this generally means that the device is currently not using this feature.
Regarding the Upgrade issue, I would request you to make sure the following ports are not being blocked by the firewall:
Firewall Ports:
Port         Protocol        In/Out  Hostname use       Description
===============================================
20/21      TCP              In or out   AsyncOS IPs     FTP server FTP for aggregation of
log files.
22           TCP              In            AsyncOS IPs     SSH access to the CLI,
aggregation of log files.
22           TCP              Out          SCP server        SCP push to log server.
23           Telnet           In            AsyncOS IPs     Telnet access to the CLI.
23           Telnet           Out          Telnet server    Telnet upgrades.
25           TCP              Out          Any SMTP to send email.
25           TCP              In            AsyncOS IPs       SMTP to receive bounced
email or if injecting email from outside firewall.
80           TCP              In or out  AsyncOS IPs,downloads.ironport.com   HTTP access
to the GUI for system monitoring. AsyncOS and Sophos upgrades are retrieved via HTTP from
port 80.
82           HTTP            In             AsyncOS IPs        Used for viewing the
IronPort Spam Quarantine.
83           HTTPS          In             AsyncOS IPs       Used for viewing the IronPort
Spam Quarantine.
53           UDP/TCP       Out           DNS servers        DNS if configured to use
Internet root servers or other DNS servers outside the firewall. Also for SenderBase
110         TCP              Out            POP server        POP authentication for end
users for IronPort Spam Quarantine.
123         UDP              Out            NTP server        NTP if time servers are
outside firewall.
143         TCP              Out            IMAP server       IMAP authentication for end
users for IronPort Spam Quarantine.
161         UDP              In              AsyncOS IPs      SNMP queries.
162         UDP              Out            Management station  SNMP traps.
389 or 3268       LDAP   Out            LDAP servers      LDAP if LDAP directory servers
are outside firewall. LDAP authentication for IronPort Spam Quarantine.
636 or 3269       LDAPS  Out           LDAPS               LDAPS ActiveDirectory's global
catalog server.
443         TCP               In             AsyncOS IPs       Secure HTTP (https) access
to the GUI for system monitoring.
443         TCP               Out           update manifests, ironport.com  -Verify the
latest files for the update server.
443         TCP               Out           phonehome.senderbase.org - Receive/send Virus
Outbreak Filters.
514         UDP/TCP        Out           Syslog server       Syslog logging.
2222       CCS               In/Out       AsyncOS IPs        Cluster Communication Service
(for centralized management).
6025       TCP               In/Out       AsyncOS IPs        Send IronPort Spam Quarantine
data to the Security Management appliance if the external IronPort Spam Quarantine is
enabled.
If it still fails, please try to use the recommended P1 interface and then try to do the upgrade.
Regards,
Kush