topic From the Experts: URL filtering implementation and troubleshooting in General Topics

From the Experts: URL filtering implementation and troubleshooting

Mauricio_Subieta — Fri, 21 Apr 2017 17:52:40 GMT

I just wanted to check with anyone that can answer, that when the URL license expires, the whole feature is disabled in PanOS 8.0.1. It used to be different, the URL filtering would still work, but there were no more updates of the database.

Thanks!

Re: From the Experts: URL filtering implementation and troubleshooting

DannyDai — Sat, 17 Jun 2017 04:41:06 GMT

one of my customer also has the same issue . when two days later than license expired , whole URL profile doesnt work. all web surfing are ok to pass through.

Re: From the Experts: URL filtering implementation and troubleshooting

acc6d0b3610eec313831f7900fdbd235 — Sat, 17 Jun 2017 06:52:20 GMT

@Mauricio_Subieta and @DannyDai

As you probably know, Palo Alto offers two types of URL filtering solutions, PAN-DB and BrightCloud.

With PAN-DB:

If the license expires for PAN-DB, URL filtering is not enforced:
URL categories that are currently in the cache will be used to either block or allow content based on your configuration. Using cached results is a security risk because the categorization information might be stale.
URLs that are not in the cache will be categorized as not-resolved and will be allowed.

I personally always recommend to customers PAN-DB instead of BrightCloud. The reason is because PAN-DB has tight integration with WildFire, in order to update URL categories such as: Malware, Phishing, and Hacking. If you are on BrightCloud, you don’t get the benefit of this integration to feed this categories from WildFire.

With BrightCloud:

If you are using the BrightCloud database, you can configure the action to take if the URL filtering license expires:
Block— Blocks access to all web sites. Upon license expiration, all URLs are blocked, not just the URL categories previously set to block.
Allow — Allows access to all web sites. Upon license expiration, all URLs are allowed, not just the URL categories set to allow.

I hope this helps.

Re: From the Experts: URL filtering implementation and troubleshooting

DannyDai — Sun, 18 Jun 2017 05:02:51 GMT

i think the default use is PAN-DB rather than brightcloud.

the experiment shows that if there is no url record on data plane this url would be allowed. when url license expired Managment plane replication to data plane was disabled . so after the cache on data plane went away , ALL urls check would be disabled / and be allowed to pass the firewall.

that is what i saw.

you can use CLI command to check

show running url xxxxxxx (for data plane)

test url xxxxxxx (for managment plane)