topic Re: URL Filtering - Category "Unknown" on Brightcloud lookup in "Adult and Pornography" in General Topics

URL Filtering - Category "Unknown" on Brightcloud lookup in "Adult and Pornography"

rotra — Tue, 29 Nov 2011 15:07:27 GMT

In our setup we have a PA-500 (PanOS 4.0.7) where we filter URL's on categories from the Brightcloud database.

We found out a website which is in the "Adult and Pornography" category when we do a lookup on the Brightcloud lookup service.

However in the monitoring tab / URL Filtering in our PA-500 this URL seems to be in the "unknown" category.

We have the latest version of teh URL filtering installed, and some sites I submitted recently are now in the correct category.

However the site keeps in the category "unknown" instead of "Adult and Pornography".

Is there something we can do to solve this ?

Re: URL Filtering - Category "Unknown" on Brightcloud lookup in "Adult and Pornography"

RNC — Wed, 30 Nov 2011 10:53:43 GMT

From CLI try 'clear url-cache'.

Re: URL Filtering - Category "Unknown" on Brightcloud lookup in "Adult and Pornography"

rotra — Wed, 30 Nov 2011 11:02:57 GMT

Tried the command to clear the URL-cache, without any result, the URL keeps in the category "unknown".

Re: URL Filtering - Category "Unknown" on Brightcloud lookup in "Adult and Pornography"

dyang — Thu, 01 Dec 2011 02:07:12 GMT

Hi, what version of PAN-OS are you using?

Re: URL Filtering - Category "Unknown" on Brightcloud lookup in "Adult and Pornography"

rotra — Thu, 01 Dec 2011 07:46:07 GMT

I'm using PanOS version 4.0.7 .

Re: URL Filtering - Category "Unknown" on Brightcloud lookup in "Adult and Pornography"

emr_1 — Thu, 01 Dec 2011 09:38:46 GMT

It sounds I have same issue before on my PA5020 v4.0.7.

Are you enabling 'dynamic url filtering' in URL Filtering Profile?

What I saw is if I use 'test url' command, it replies specific category from cloud-db,

though, logged URL traffic shows me 'unknown'

Emr

Re: URL Filtering - Category "Unknown" on Brightcloud lookup in "Adult and Pornography"

dyang — Thu, 01 Dec 2011 19:26:27 GMT

Hi guys,

If you both have Dynamic URL Filtering enabled and are still getting URLs categorized as "unknown", please file a ticket with our Support team so we can further investigate. Assuming that you've already tried to clear the cache via the CLI command, please also include that in your ticket details so we know that you've tried it already.

Thanks,

Doris

Re: URL Filtering - Category "Unknown" on Brightcloud lookup in "Adult and Pornography"

lildeniz — Thu, 01 Dec 2011 22:46:33 GMT

Hi,

i have same problem with this version

regards

Re: URL Filtering - Category "Unknown" on Brightcloud lookup in "Adult and Pornography"

lildeniz — Fri, 02 Dec 2011 14:42:47 GMT

do u have any solution?

Re: URL Filtering - Category "Unknown" on Brightcloud lookup in "Adult and Pornography"

rotra — Fri, 02 Dec 2011 15:11:31 GMT

I've enabled "Dynamic URL Filtering" and with the "test url" command the url is correctly categorized as "Adult and Pornography".

By now the URL is still categorized as "unknown" in the monitoring.

After this I executed the command "clear url-cache" in the CLI the URL is also categorized as "Adult and Pornography" in the monitoring (and blocked for the visitor).

Re: URL Filtering - Category "Unknown" on Brightcloud lookup in "Adult and Pornography"

lildeniz — Fri, 02 Dec 2011 15:35:12 GMT

Thanks

Re: URL Filtering - Category "Unknown" on Brightcloud lookup in "Adult and Pornography"

dyang — Fri, 02 Dec 2011 16:49:19 GMT

@rotra Good to hear that this has been resolved.

For those of you in a similar situation, please remember that you must enable the setting "Dynamic URL Filtering" to access the BrightCloud database in the cloud for the latest categorization information. Otherwise, the URL filtering engine will only check for categorization on-device. If the specific URL you're looking for is not stored on the device, it will return category "unknown". Keep in mind that information is also cached on the device, so if you enable the dynamic URL filtering setting after you've started, you should use the "clear url-cache" command to clear the cache and force a cloud lookup for the latest categorization. Otherwise, you will use the cached category until that entry expires in the cache.

Hope this helps,

Doris