topic Re: Url Filtering Doesnt Works (not-resolved) in General Topics

Url Filtering Doesnt Works (not-resolved)

BankRespublika — Wed, 29 Jun 2016 07:48:19 GMT

We faced with problem in URL filtering. While trying to open any site PA returns blocked mesage and url category : unknown.

This is the output from CLI :

test url nasa.gov

nasa.gov not-resolved (Base db) expires in 0 seconds
nasa.gov government (Cloud db)

The same output for any site.Resolving works.

ping host nasa.gov
PING nasa.gov (52.0.14.116) 56(84) bytes of data.

I have already redownload URL DB.The same result.

what could be the problem?

Re: Url Filtering Doesnt Works (not-resolved)

TranceforLife — Wed, 29 Jun 2016 08:26:37 GMT

Hi,

Things to check:

1) Licences

2) reachability: > show url-cloud status

3) active or not: > show system setting url-database

https://www.paloaltonetworks.com/documentation/60/pan-os/pan-os/url-filtering/troubleshoot-url-filtering

Re: Url Filtering Doesnt Works (not-resolved)

kiwi — Wed, 29 Jun 2016 08:33:12 GMT

Can you do 'show url-cloud status' and confirm it is connected ?

If not then you might be missing the seed file.

You can download it again using :

request url-filtering download paloaltonetworks region <value>

Make sure you are allowed to download it ... I've seen cases where pan-db application was hitting a deny rule preventing you from downloading the seed file.

I hope this helps,

-Kim.

Re: Url Filtering Doesnt Works (not-resolved)

BankRespublika — Wed, 29 Jun 2016 09:05:25 GMT

there is the output from show url-cloud status

License : valid
Current cloud server : s0100.urlcloud.paloaltonetworks.com
Cloud connection : connected
Cloud mode : public
URL database version - device : 2016.06.28.417
URL database version - cloud : 2016.06.28.417 ( last update time 2016/06/29 12:59:10 )
URL database status : good
URL protocol version - device : pan/0.0.2
URL protocol version - cloud : pan/0.0.2
Protocol compatibility status : compatible

Re: Url Filtering Doesnt Works (not-resolved)

TranceforLife — Wed, 29 Jun 2016 09:23:10 GMT

Hi,

Please try to clear the cash:

> clear url-cache all

and send the following command output:

> show system resources follow

monitor for some time and see your CPU% utilisation

Re: Url Filtering Doesnt Works (not-resolved)

BankRespublika — Wed, 29 Jun 2016 09:51:22 GMT

hi,

there is the output from show system resources follow

Cpu(s): 7.1%us, 6.2%sy, 0.0%ni, 82.7%id, 1.0%wa, 0.0%hi, 3.0%si, 0.0%st
Mem: 4056352k total, 3830540k used, 225812k free, 26868k buffers
Swap: 2097080k total, 127940k used, 1969140k free, 2551712k cached

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME COMMAND

2511 root 20 0 1851m 1.7g 1.7g S 24.2 43.3 9528:21 pan_task
2514 root 20 0 1779m 1.7g 1.7g S 16.9 43.3 6195:36 pan_task
2515 root 20 0 1779m 1.7g 1.7g S 16.3 43.3 6124:06 pan_task
2516 root 20 0 1779m 1.7g 1.7g S 16.3 43.3 6175:45 pan_task
2517 root 20 0 1779m 1.7g 1.7g R 15.9 43.3 6108:28 pan_task
2512 root 20 0 1779m 1.7g 1.7g S 12.6 43.3 4588:40 pan_task
2513 root 20 0 1779m 1.7g 1.7g S 8.0 43.3 3367:40 pan_task
2509 root 20 0 2321m 1.7g 1.7g S 3.3 44.2 1758:36 pan_comm

Re: Url Filtering Doesnt Works (not-resolved)

TranceforLife — Wed, 29 Jun 2016 11:20:47 GMT

Hi hi,

CPU looks ok.

Honestly don't have much experience with PAN-DB . Found another good article :

https://live.paloaltonetworks.com/t5/Management-Articles/Testing-URL-from-the-CLI-Returns-quot-expires-in-0-seconds-quot/ta-p/61724

This might help you

Re: Url Filtering Doesnt Works (not-resolved)

BPry — Wed, 29 Jun 2016 13:04:45 GMT

Does your management port have an active internet accessable connection at all. It could be that you need to put in service routes to actually get this feature to work properly if you have already verified that your policy set isn't blocking the PA from resolving the address. If you are funneling out service requests from the outside interface you may not actually be allowing the interface a DNS connection.

Re: Url Filtering Doesnt Works (not-resolved)

pankaku — Wed, 29 Jun 2016 17:11:44 GMT

what is the service route for palo alto updates, DNS?

Is the management traffic going through palo alto data interface? If yes try to create a policy on top to allow the traffic from management ip and alos check if you have proper nat rule.

Check if you are able to resolve domain to ip or not.