topic Re: URL Category "any" in General Topics

URL Category "any"

charger — Wed, 27 Feb 2013 16:46:35 GMT

Hi,

I'm configuring my new PA3020. It is my first experience with the device and so far things seem to be going well. Here is my setup:

PA3020 positioned between current firewall and core switch in TAP mode.

URL Filtering license installed.

My question is:

When I look at the traffic logs I see that ~90% of the entries have a URL Category of "any". Even when the application is resolved, ie. facebook-base, the URL category is "any".

Is this normal behavior?

Any assistance is greatly appreciated.

Re: URL Category "any"

torm — Wed, 27 Feb 2013 21:07:42 GMT

I think 'any' means that the traffic hasn't undergone url categorization. Have you downloaded and installed the URL database under dynamic updates?

You can test if the the url categorization is working with the command "test url"

Re: URL Category "any"

charger — Wed, 27 Feb 2013 21:45:47 GMT

Thanks for the reply.

URL database doesn't appear in the "Dynamic Updates" section:

The only place I can see that references it is in the "Licenses" section:

I've run the test url with the following results:

test url-info-host pokerstars.net

Ancestors info:

BM:

pokerstars.net,1,3,gambling,,

and

test url-info-cloud pokerstars.net

BM:

pokerstars.net,9,3,gambling

I'm not sure I understand the output.

Re: URL Category "any"

torm — Wed, 27 Feb 2013 22:03:00 GMT

I assumed you were using brightcloud database, and not pan-db. From the screenshot, you're pan-db url looks to be downloaded just fine.

Try going through the troubleshooting part of the following document:

Also, you can find some useful commands here:

For pan-db the test commands looks to be "test url-info-cloud" and "test url-info-host"

Re: URL Category "any"

SCoupland — Wed, 27 Feb 2013 22:19:10 GMT

URL categorisation only occurs if we perform URL filtering. Do you have a URL filtering profile applied to the policy that the traffic is hitting? It could simply be a URL filtering profile with all categories set to allow.

Re: URL Category "any"

charger — Wed, 27 Feb 2013 22:50:09 GMT

That was it!

Added a URL filter profile to the policy and now URLs are being categorized.

Thanks alot for the help!

Re: URL Category "any"

santonic — Wed, 20 Aug 2014 08:21:31 GMT

In my case: I don't have URL filtering license, so I only have a couple of custom URL categories defined. On the rule I'm working on I don't have URL filterig security profile applied. I only have my custom URL category used in URL Category field of security rule. As far as I know in such case URL categorisation should still be applied? Yet I have 'any' as URL category in traffic logs which implies URL categorization wasn't even applied.

Any ideas why is this not working?