topic Re: PAN DB vs Advanced in Advanced Threat Prevention Discussions

PAN DB vs Advanced

FWPalolearner — Mon, 29 Nov 2021 12:43:50 GMT

Hello ,

Just want to know if PAN-DB and Advanced URL are different licensing

If Advanced URL is purchased , does it cover PAN-DB

We have a customer who puchased Advanced URL , but not PAN DB

Re: PAN DB vs Advanced

SutareMayur — Mon, 29 Nov 2021 13:55:40 GMT

Hi @FWPalolearner ,

Yes, the advanced URL filtering license covers access to PAN DB. No need to have separate license for PAN DB if you already have Advanced URL filtering license.

Hope it helps!

Re: PAN DB vs Advanced

FWPalolearner — Mon, 29 Nov 2021 18:56:12 GMT

Ok .thanks.

Just small query.

When I click on objects tab and go to url filtering .

At the bottom it shows url filtering license expired . Is it normal ?

How can I check that pan db url actually works

Re: PAN DB vs Advanced

TomYoung — Tue, 30 Nov 2021 00:26:45 GMT

Hi @FWPalolearner ,

Scroll down on this link -> https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/datasheets/integrated-url-filtering-datasheet and you will see a table of the features in URL and Advanced URL filtering. The 1st line, "URL filtering database" is PAN-DB.

A license expired message is not normal. You may need to "Retrieve license keys from license server" under Device > License.

Yes, you can test URL categorization on the NGFW. Use the "test url" command on the CLI -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClQcCAK. On the bottom of the link it has special PANW URLs you can test for each category.

Thanks,

Tom

Re: PAN DB vs Advanced

FWPalolearner — Tue, 30 Nov 2021 04:03:15 GMT

@SutareMayur Thanks .

License part is clear , but i tried to retrive license key but no luck ;

below is the snapshot

Also ,when i go to objects TAB and click on URL filtering , i see below

Re: PAN DB vs Advanced

TomYoung — Tue, 30 Nov 2021 04:12:43 GMT

Hi @FWPalolearner ,

That is very strange. I have the Advanced URL Filtering license, and my license page shows the Advanced and PAN-DB good. I guess you need to open a TAC case. Thanks for the pics!

Thanks,

Tom

Re: PAN DB vs Advanced

FWPalolearner — Tue, 30 Nov 2021 05:17:50 GMT

@TomYoung I deleted the PAN_DB license key via CLI

Now i cant see PAN DB license ; and only see Advanced License which is valid

I tried request license fetch .

On the URL Filtering TAB i see below now

The FW however shows PAN DB is good

(active)> show url-cloud status

PAN-DB URL Filtering
License : valid
Current cloud server : serverlist.urlcloud.paloaltonetworks.com
Cloud connection : connected
Cloud mode : public
URL database version - device : 20211130.20072
URL database version - cloud : 20211130.20072 ( last update time 2021/11/30 05:44:05 )
URL database status : good
URL protocol version - device : pan/2.0.0
URL protocol version - cloud : pan/2.0.0
Protocol compatibility status : compatible

I want to get rid of GUI error showing "License Required for URL filtering to Function"

Re: PAN DB vs Advanced

TomYoung — Tue, 30 Nov 2021 05:26:48 GMT

Hi @FWPalolearner ,

Good news! Excellent work. Try making a change and committing to see if the GUI error goes away.

Thanks,

Tom

Re: PAN DB vs Advanced

SeanDeHarris — Tue, 25 Jan 2022 03:01:38 GMT

Hi @FWPalolearner ,

Just wondering what version of PAN-OS you are using?
Did you finally fix the license expired issues under Device > License ?

Thanks,

Sean

Re: PAN DB vs Advanced

SeanDeHarris — Wed, 26 Jan 2022 02:13:10 GMT

Hi @TomYoung

What PANOS you are using,

mine is 8.1 but it did not show the A-URL subscription in the WebUI

:'(
thanks

Sean

Re: PAN DB vs Advanced

John_Stuart — Fri, 04 Feb 2022 04:29:17 GMT

I'm running 8.1.6 and have the same issue. Just renewed licenses. I wound up here searching for an answer to the question of Did Advanced URL Filtering supplant Pan-DB URL Filtering?

Re: PAN DB vs Advanced

SeanDeHarris — Mon, 07 Feb 2022 09:17:30 GMT

I bet it's still common some PA firewall still running PANOS 8.1 version but have been renewed/migrated old PAN-DB lic to Advanced URL Lic because the Old PAN-DB lic has been discontinued since last Nov. The "New" A-URL lic has all the PAN-DB lic (functionality) + the Machine-learning function/new EDL when you upgrade to PANOS 9.x upwards.

Here's the steps taken to fixed the PAN-DB lic issue in PANOS 8.1 by the following steps, and A-URL subscription can be shown in WebUI.

1) Manually download the A-URL license file from the customer support portal (Fetch from the WebUI not working)

2) Install the A-URL lic key on your firewall (thru WebUI)

3) Use CLI to remove the old existing (PAN-DB) license

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000oMntCAE

Hope this helps,

Sean

**** FYI, the PANOS 8.1 will be end of support by March 2022, it's time to plan for the upgrade. ****

Re: PAN DB vs Advanced

TomYoung — Mon, 07 Feb 2022 16:09:26 GMT

Hi @SeanDeHarris ,

Exactly! I just did the same thing for a customer the other day. They upgraded from URL to Advanced URL. URL is not sold anymore. We are going to see this a lot. Your reply should be marked as the solution. The same process works for 9.1.

Thanks,

Tom

Re: PAN DB vs Advanced

Kobiher — Sat, 12 Feb 2022 12:38:28 GMT

I know we had a similar issue and when raising a case with PA TAC they advised to refer to PAN-178194. here is a brief of the reply from PA TAC:

==> PAN-178194: A UI issue in PAN-OS renders the contents of the Inline ML tab in the URL Filtering Profile inaccessible on firewalls licensed for Advanced URL Filtering. Additionally, a message indicating that a License required for URL filtering to function is unavailable displays at the bottom of the UI. These errors do not affect the operation of Advanced URL Filtering or URL Filtering Inline ML.

+ Workaround: Configuration settings for URL Filtering Inline ML must be applied through the CLI. The following configuration commands are available:

+ Define URL exceptions for specific web sites:

# configure
# set profiles url-filtering <url_filtering_profile_name> mlav-category-exception

+ Configuration settings for each inline ML model:

# configure
# set profiles url-filtering <url_filtering_profile_name> mlav-engine-urlbased-enabled

==> The target Fix versions for this issue are 9.0.16, 9.1.13, 10.0.9 and 10.1.5. You can also either ignore the warning message about the URL license or apply the workaround mentioned previously through the CLI.

Hope that help all

@SeanDeHarris Thanks for the info - any idea how to automat this ? we have a customer with over 150 devices worldwide so we can't really do this one-by-one...

BR,

Yaakov (kobi) H

Re: PAN DB vs Advanced

TomYoung — Sat, 12 Feb 2022 19:01:05 GMT

Hi @Kobiher ,

With regard to automating CLI, you could look into Ansible, Python Parmiko, Expect, etc. Your question probably should be a separate post under this forum -> https://live.paloaltonetworks.com/t5/automation-api-discussions/bd-p/TechnologiesSDKsDiscussions.

Thanks,

Tom

Re: PAN DB vs Advanced

santonic — Fri, 15 Apr 2022 06:13:17 GMT

It seems PAN-178194 wasn't resolved even in 10.1.5-h1? I have a new PA-440 (which never had old URL filtering license) with valid Advanced URL license yet the WebUI shows error when on URL filtering object and I can't edit ML settings there.

Re: PAN DB vs Advanced

Kobiher — Fri, 22 Apr 2022 20:42:04 GMT

Hey Santonic,
Did you raise a case with support ? has there been any progress with that issue on your end ? we were advised to go to each device and manually delete the license files (which makes sense, but not in a 100-s of devices scenario), but also that there will be a fix for that issue in an upcoming version

Re: PAN DB vs Advanced

santonic — Mon, 25 Apr 2022 07:25:06 GMT

No, I didn't open a case (yet). Tbh there's so many bugs lately, especially with 10.1, so I'm only opening cases for the most critical ones.

Not sure deleting license would help me in my case as I never had old URL license on this box.

Re: PAN DB vs Advanced

Pras — Wed, 31 Aug 2022 07:07:29 GMT

Does this mean that if some one has a PAN DB and Advance PAN DB together (because they bought Adv PAN DB before the PAN DB expired), Advance PAN DB will take over ( like there is no meaning of the existing PAN DB)?

Re: PAN DB vs Advanced

SeanDeHarris — Wed, 31 Aug 2022 07:28:52 GMT

I guess this happened to those customers who have renewed from the old URL lic/PAN DB lic to A-URL lic.

There's no additional value to buy A-URL to the same box when the PAN DB lic has not expired.