topic Re: 5.0.3 PAN Firewalls and 5.0.3 Panorama in General Topics

5.0.3 PAN Firewalls and 5.0.3 Panorama

dacci — Mon, 18 Mar 2013 16:55:27 GMT

I have an open case already but I would like to post this out to the community. We recently purchased a new Panorama device and new 3050 firewalls and noticed during the configuration of the URL Filtering section that while the new firewalls have the new listed categories such as "cheating" and "illegal", the Panorama server does not have them listed. Therefore, I cannot manage these two categories from Panorama; in addition, because I created the profile at the Panorama, I cannot manage them at the firewall either. Has anyone run across this before? if so, what is the solution? Thank you in Advance.

Re: 5.0.3 PAN Firewalls and 5.0.3 Panorama

bnelson — Mon, 18 Mar 2013 17:03:54 GMT

It sounds like you are using 2 different URL databases. Most likely, the firewall is using Brightcloud and Panorama is using Surfcontrol, but one may be using paloaltonetworks (pandb). You can verify this by executing the command on both devices:

show system setting url-database

You will want to verify which URL DB you are licensed for from the Device tab > Licenses page, then set the correct db on both devices, if needed, with the following command:

set system setting url-database {brightclooud | pandb}

Ben

Re: 5.0.3 PAN Firewalls and 5.0.3 Panorama

dacci — Mon, 18 Mar 2013 17:09:23 GMT

I checked as you suggested and all systems (Panorama and firewalls) are running brightcloud. The Panorama does not show a listing for URL licensing but each firewall is licensed to use brightcloud.

Re: 5.0.3 PAN Firewalls and 5.0.3 Panorama

dacci — Mon, 18 Mar 2013 17:16:46 GMT

I also went ahead and force a "set" to use brightcloud at the panorama (where the problem is) but it came saying "Server error : URL database already set to 'brightcloud'"

Re: 5.0.3 PAN Firewalls and 5.0.3 Panorama

bnelson — Mon, 18 Mar 2013 17:57:43 GMT

Panorama retrieves the URL or BrightCloud content with the Applications and Threats updates. Panorama only retrieves the URL categories, as it does not require the entire URL database. What Applications and Threats version is on Panorama? Are you on the latest version?

Ben

Re: 5.0.3 PAN Firewalls and 5.0.3 Panorama

dacci — Mon, 18 Mar 2013 19:21:05 GMT

ok. It was discovered that from the Panorama tab, the dynamic updates was not configured; therefore, I set the schedule and forced an initial download and install to get things going which finally allowed me to see the missing categories at the Panorama level. Issue is now resolved. Thank you for your input!

Re: 5.0.3 PAN Firewalls and 5.0.3 Panorama

bnelson — Mon, 18 Mar 2013 19:28:17 GMT

You're welcome. I'm glad to hear the issue was a fairly simple one that was easily resolved.

Ben