topic Re: URL Categorization suddenly failing as not-resolved for Google search URLs in General Topics

URL Categorization suddenly failing as not-resolved for Google search URLs

Adrian_Jensen — Wed, 06 Sep 2023 21:19:45 GMT

Is anyone else seeing sudden failures in URL categorization for Google searches? Starting within the last hour or so we are seeing intermittent blocks as not-resolved for search URLs, but not for the Google homepage or any other websites (that I have been able to find so far). Initial error seem to be a HTTP2 compression error to the Google server, followed by not-resolved categorization for any search URLs in the form https://www.google.com/search?q=test.... After a few minutes it works again for a couple tries, then goes back to not-resolved.

URL-cloud database connection is valid and updating normally. No other errors in the PA logs that I can find. Anyone seeing similar?

Edit: Also seeing not-resolved errors for https://www.google.com/maps URLs as well.

Re: URL Categorization suddenly failing as not-resolved for Google search URLs

IRCSO_ACollier — Wed, 06 Sep 2023 21:38:44 GMT

Yes, we started seeing the same thing on any Google Search page as of about 4:40PM Eastern. Opening a ticket now.

Re: URL Categorization suddenly failing as not-resolved for Google search URLs

therealpackerhacker — Wed, 06 Sep 2023 21:42:19 GMT

We're experiencing the same issue.

Re: URL Categorization suddenly failing as not-resolved for Google search URLs

Adrian_Jensen — Wed, 06 Sep 2023 21:45:43 GMT

Yes, digging thru my PA logs even deeper. Seeing it started at 13:03 GMT-7 (with a few more intermittent in the 11:30-12:30 range), for URLs:

www.google.com/search?

www.google.com/maps/

www.google.com/recapcha/

www.google.com/?gws_id=

www.google.com/url?

chat.google.com/

accounts.google.com/

play.google.com/

adservice.google.com/

meet.google.com/

analytics.google.com/

mail.google.com/

Re: URL Categorization suddenly failing as not-resolved for Google search URLs

huntrepj — Wed, 06 Sep 2023 21:52:15 GMT

Same here. Although news.google.com is working. I noticed they have set their TTL to 300 secs.

Re: URL Categorization suddenly failing as not-resolved for Google search URLs

IRCSO_ACollier — Wed, 06 Sep 2023 21:54:48 GMT

Yup. Ticket is open with support. Just updated all my filters that had it set to "continue" to "alert" for the time being to avoid user issue calls. Don't want to leave it that way for long, but at least it works for the moement.

Re: URL Categorization suddenly failing as not-resolved for Google search URLs

Adrian_Jensen — Wed, 06 Sep 2023 22:00:50 GMT

Yeah, I was going to possibly add www.google.com/ to my custom URL category allow filter for the time being. In discussions with our Infosec department. Don't want to leave it that way for long, but it is a simple bypass in the mean time.

Re: URL Categorization suddenly failing as not-resolved for Google search URLs

ahameed — Wed, 06 Sep 2023 23:25:41 GMT

Hi,

increasing the ncreasing the Category lookup timeout (sec) value to 4 sec resolved it in my case just FYI
references:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000001Uq8CAE&lang=en_US%E2%80%A9 https://docs.paloaltonetworks.com/advanced-url-filtering/administration/troubleshooting/urls-classified-as-not-resolved

Re: URL Categorization suddenly failing as not-resolved for Google search URLs

fmedranoIII — Thu, 07 Sep 2023 17:23:27 GMT

thanks going to give this a try. We noticed it was happening with URLs with extended lengths but still under the 256 character limit. Started at the same time yesterday as everyone else.

Re: URL Categorization suddenly failing as not-resolved for Google search URLs

ahameed — Thu, 07 Sep 2023 21:56:26 GMT

Hi Everyone,

Just an update, engineering team has applied the short-term fix, and you shouldn't see the 'not-resolved' issue constantly, they will be working on permanent fix to fundamentally resolve the Pandb cloud performance issue caused by massive google URL publishing and this fix will be transparent to customers in future. So right now, you can start to undo the workaround implemented ( whitelisted *.google.com URLs, Increase Category lookup timeout (sec) values) if you prefer.

Thanks!

Re: URL Categorization suddenly failing as not-resolved for Google search URLs

Adrian_Jensen — Fri, 08 Sep 2023 00:00:20 GMT

Yes, I saw this a bit earlier today. This morning it was still showing up as "not-resolved" in the local cache:

adrian.admin@PA-HA(active)> test url www.google.com/search www.google.com/search not-resolved (Base db)expires in 5 seconds www.google.com/search search-engines low-risk (Cloud db) adrian.admin@PA-HA(active)> test url-info-host www.google.com/search www.google.com/search: Doesn't exist in the URL DB adrian.admin@PA-HA(active)> test url-info-cloud www.google.com/search BM: google.com/search,9,5,search-engines,low-risk google.com/search?q=community+first+foundation+site:coloradogivesfoundation.org%26rlz=1c1gceb%5fenus848us848%26sa=x%26ve d=2ahukewid0j394j3%5fahxredqihtntcluqran6bagteae%26cshid=1685474396026528,9,5,society,low-risk

Then this afternoon it started showing up as matching the cloud category but doesn't actually exist in the local DB (though it somehow shows as cached with an expiration date in an overall query...). Seems like they pushed something that always cancels local caching for the google.com URLs.

adrian.admin@PA-HA(active)> test url www.google.com/search www.google.com/search search-engines low-risk (Base db)expires in 1650 seconds www.google.com/search search-engines low-risk (Cloud db) adrian.admin@PA-HA(active)> test url-info-host www.google.com/search www.google.com/search: Doesn't exist in the URL DB adrian.admin@PA-HA(active)> test url-info-cloud www.google.com/search BM: google.com/search,9,5,search-engines,low-risk google.com/search?q=community+first+foundation+site:coloradogivesfoundation.org%26rlz=1c1gceb%5fenus848us848%26sa=x%26ved=2ahukewid0j394j3%5fahxredqihtntcluqran6bagteae%26cshid=1685474396026528,9,5,society,low-risk

We have undone our temporary fix and so far not seen any issues.

Re: URL Categorization suddenly failing as not-resolved for Google search URLs

RoneyRajan123 — Mon, 27 Nov 2023 12:03:06 GMT

Hi Team

Is there any update for this issue, the same issue is faced by on of my customer as well.

Regards

Roney Rajan

Re: URL Categorization suddenly failing as not-resolved for Google search URLs

therealpackerhacker — Wed, 29 Nov 2023 19:29:12 GMT

It happened again. Google.com is not resolving. Looks like it's mostly related to docs.google.com and drive.google.com

Put temp fix back in place.

Re: URL Categorization suddenly failing as not-resolved for Google search URLs

Adrian_Jensen — Wed, 29 Nov 2023 19:39:41 GMT

15min or so it was not working for a couple minutes, but has already resolved itself.

I have seen this multiple times over the last few weeks as it will temporarily not resolve for a minute and then work normally again. It looks like PA still has the temporary patch in. Not sure if they are testing patch removal or the patch fails momentarily from time to time.

Re: URL Categorization suddenly failing as not-resolved for Google search URLs

RoneyRajan123 — Wed, 24 Jan 2024 08:40:10 GMT

Hi @Adrian_Jensen @ahameed @therealpackerhacker @fmedranoIII

I am also facing the same issue and affecting the business as well, is there any permanent fix for this issue or not?

My PAN-OS version is 10.1.9-h3

Regards

Roney Rajan

Re: URL Categorization suddenly failing as not-resolved for Google search URLs

RoneyRajan123 — Wed, 24 Jan 2024 08:44:30 GMT

Hi @IRCSO_ACollier

did you get any update from support?

Permeant fix?

I am running 10.1.9-h3