topic Re: URL Filtering Category is "Unknown" in General Topics

URL Filtering Category is "Unknown"

AhmedSheta — Wed, 24 Sep 2014 08:05:42 GMT

guys,

i have a problem in our Palo alto 5050, it shows a lot of URL websites with Category "unknown", although it shows the right category type on bright cloud website,

any help ??,

Regards,

Re: URL Filtering Category is "Unknown"

HULK — Wed, 24 Sep 2014 08:23:32 GMT

Hello AhmedSheta,

By default, any newly registered domain will be "unknown" in PAN-DB until Palo Alto Networks reviews, either manually by the analysis/threat team, or through the crawler (triggered on some event). Once an "unknown" is seen on the Palo Alto Networks servers, it will be put into a prioritized queue for crawling and classification. Once Palo Alto Networks determines a category, it will be included in the next database refresh.

Enable global setting to force dynamic-url lookup:

# set deviceconfig setting url dynamic-url yes

# commit

You may clear the cache with CLI command:

> clear url-cache all

Few related discussions/doc for your reference:

resolving

Many 'Unknown' Entries In URL Log

User Web Traffic Categorized as Unknown

Hope this helps.

Thanks

Re: URL Filtering Category is "Unknown"

AhmedSheta — Wed, 24 Sep 2014 08:55:50 GMT

thanks so much for your reply,

but our problem is like below :

when you test the url on cli using test url ......

it shows the category,

but on the url filtering logs it shows like that

so any help ???

Re: URL Filtering Category is "Unknown"

HULK — Wed, 24 Sep 2014 09:05:11 GMT

Could you please follow the DOC and clear cache from both data-plane and management-plane: How to Handle a URL Miscategorization

Thanks

Re: URL Filtering Category is "Unknown"

HULK — Wed, 24 Sep 2014 09:22:22 GMT

Any progress on this...?

Thanks

Re: URL Filtering Category is "Unknown"

AhmedSheta — Wed, 24 Sep 2014 09:57:14 GMT

it works, but should i do this everytime manually when i see unknown traffic, why the palo alto is not directly adjust it,

Regards,

Re: URL Filtering Category is "Unknown"

HULK — Wed, 24 Sep 2014 11:45:44 GMT

Hello AhmedSheta,

The device will automatically refresh it's cache table with updated information from the cloud. There is a process that executes the attempts to see if any cached entry in the DP URL cache has been updated with new on-device database.

Can be manually cleared using the following CLI command from Managaement-Plane:

> deletedynamic-url <argument>

Can manually set dynamic URL cache timeout value through the following CLI command:

> debug device-server reset url dynamic-url-timeout <1-43200>

Can be manually cleared using the following CLI command from Data-Plane:

> clear url-cache

Thanks

Re: URL Filtering Category is "Unknown"

pulukas — Wed, 24 Sep 2014 21:46:54 GMT

AhmedSheta you can change the default cache time to a shorter interval. By default this is set to a week. I like to reduce this to one day. This prevents the issues you have here with newly categorized sites not being properly recognized.

Updates in url filtering may be delayed by days in application to sessions