topic Re: Difference in URL block categories between panorama and device in General Topics

Difference in URL block categories between panorama and device

rroberts — Tue, 30 Nov 2010 03:53:00 GMT

I have 2 PA-2050 being managed by panorama, all running 3.1.6. I am using the brightcloud url filtering service we paid for and both devices are up to date.

When I do a commit all from panorama it shows "commit all succeeded", however when I check the details of the commit I get a list of messages similar to "member arts is an invalid reference".

I can see that the URL block categories on the devices are obviously different than those listed in the panorama URL filtering security profile in panorama. I didn't find anything in the admin guide or the release notes.

Can anyone explain this anomoly?

I have attached an image of the default URL block categories on the device as well as the ones pushed to the device by panorama.

Re: Difference in URL block categories between panorama and device

James — Tue, 30 Nov 2010 16:29:38 GMT

Hi There,

Looks like Panorama booted up with the Surfcontrol Database and not the Brightcloud one. Please use this command:

admin@Panorama> set system setting url-database brightcloud

You should then get the same categories.

Best Regards

James

Re: Difference in URL block categories between panorama and device

rroberts — Tue, 30 Nov 2010 16:39:31 GMT

This has resolved my issue. Thank you James.

Re: Difference in URL block categories between panorama and device

gmoerschel — Tue, 08 Mar 2011 18:07:25 GMT

Is this the only command that needs to be issued in Panorama to convert and download the Brightcloud categories? Or is it like the firewalls where you activate Brightcloud then do a second step to download the database from Brightcloud.

Re: Difference in URL block categories between panorama and device

rroberts — Tue, 08 Mar 2011 18:20:28 GMT

gmoerschel,

That is the only command required as there is no activation required on the Panorama appliance. It is simply used so the URL filtering categories will match what has already been configured on the PA appliances.

Re: Difference in URL block categories between panorama and device

KGC — Tue, 08 Mar 2011 19:02:50 GMT

I seem to recall we had some issues with the brightcoud database versions being out of sync between Panorama and the firewall as well, or am I imagining this? Brightcloud either changed the names of the categories or added/removed some of them at some point.