topic PAN-DB URL Filtering Categories list for PAN-OS 10.1.x in General Topics

PAN-DB URL Filtering Categories list for PAN-OS 10.1.x

emekaokereke — Fri, 25 Nov 2022 10:41:30 GMT

Does this document below apply to PAN-OS 10.x.x or just for <9.1

Where Can I Find a Complete List of PAN-DB URL Filtering Catego... - Knowledge Base - Palo Alto Networks

We are trying to block URLs on both 9.1.x & 10.1.x, but it seems there are URL categories on the document that are not available for all versions of PAN-OS. We implemented a change on the Panorama to commit and push to block the URLs for 10.1.16-h6, but the scheduled change didn't go through but did for the PAN-OS 9.1.8

Re: PAN-DB URL Filtering Categories list for PAN-OS 10.1.x

PavelK — Fri, 25 Nov 2022 12:54:43 GMT

Hello @emekaokereke

thanks for posting in LIVEcommunity!

This should not be a case. All URL categories in PAN-DB are available in all PAN-OS versions from 9.1.X and higher. Did you get any error while pushing the change from Panorama? If yes, could you share details of the error?

Kind Regards

Pavel

Re: PAN-DB URL Filtering Categories list for PAN-OS 10.1.x

A_Astardzhiev — Sun, 27 Nov 2022 10:19:09 GMT

Hey @emekaokereke ,

URL categories are maintained with dynamic content updates - introduction to new categories, changing category action for default profile. And if I am not mistaken it pushed with Application content updates. Which means that any firewall with active support license you receive the latest list of URL categories.

As @PavelK suggest, check the details of the failed commit on the firewall - or just try to push it again from Panorama. It is very possible that problematic FW doesn't use same application content package as the Panorama and it haven't receive the latest URL category, which has been used in the config pushed by the Panorama.

Note that month or two ago, Palo Alto have introduced new URL category ransomware, I am guessing that the problematic FW is not using the app content introducing this category and push from Panorama is failing