topic Re: All sites registering as "unknown" in General Topics

All sites registering as "unknown"

mmartin — Tue, 19 Mar 2013 15:27:27 GMT

Came in today with users screaming that they were getting blocked on all websites. Finally extracted enough information from them that the category was coming up as “unknown” for all sites…even Google. Decided it had to be an issue in the URL filtering…updated to latest Brightcloud…no change.

Thought URL cache or dynamic URL cache might be the issue. SSH-ed into the firewall and issued a clear url-cache all. That fixed it. Seems that the URL cache was corrupted. BTW…I am running 5.0.3 on my PA.

Just thought I would pass that bit of information around in case you encounter that issue, too.

Has anyone else seen this before?

Re: All sites registering as "unknown"

jay.martin — Tue, 19 Mar 2013 18:59:27 GMT

Grrrr!!! - I wondered why our decryption was not working (it's based on URL category)! Same issue here - 5.0.3 on 4060 - cleared cache and that resolved. Did you open a case? Interestingly (not sure if coincidence or not) our 4060's dataplane restarted this morning, within 30 seconds of the updated BrightCloud DB being installed (url-filtering-version: 4058). I am seeing lots of "unknown" category being logged across our other platforms as well.

Re: All sites registering as "unknown"

mmartin — Tue, 19 Mar 2013 19:08:39 GMT

I am running a PA-500. Yes, I did open a case. Support had to clear the cache again, but all seems to be fine right now. I am going to try a manual Brightcloud update after-hours and see how it goes.

Re: All sites registering as "unknown"

jay.martin — Tue, 19 Mar 2013 19:16:35 GMT

Thanks - I just opened a case as well - we have around 70 firewalls, and most, if not all look to have this issue. Kinda hard to manually clear cache very quickly on 70 firewalls. I sure hope they know what's going on and how to stop it!!!

Re: All sites registering as "unknown"

licenselu — Tue, 19 Mar 2013 19:25:11 GMT

Hi all,

Is the problem limited to 5.0.3 or it affects all releases ?

Regards,

Re: All sites registering as "unknown"

jay.martin — Tue, 19 Mar 2013 22:31:57 GMT

Support told me it affects all releases using BrightCloud (that's gotta be a lot of their customers!).

Re: All sites registering as "unknown"

mfcuns — Tue, 19 Mar 2013 22:51:42 GMT

I'm running 5.0.3 URL Filtering version BrightCloud 4057

Running "clear URL-cache all" didn't resolve the issue.

Support had me run the following commands to re-establish a connection with BrightCloud:

admin@PAN(active)> set system setting url-filtering-feature filter true

admin@PAN(active)> set system setting url-filtering-feature cache true

debug software restart device-server

After waiting 15 mins. for the server to restart, ran "clear URL-cache all" again and that seemed to fix the issue.

Re: All sites registering as "unknown"

dyang — Wed, 20 Mar 2013 01:51:25 GMT

Hi everyone,

For those of you who haven't already, please open a case with Support so that we can properly troubleshoot this. While I understand that the combination of restarting the device server and clearing the URL cache is able to resolve the issue for some, we'd like to fully understand the root cause behind this. If you're able to spare it, please do not run the recommended commands so that we can troubleshoot your device.

Thanks in advance for your patience and understanding,

Doris

Re: All sites registering as "unknown"

ericgearhart — Wed, 20 Mar 2013 13:49:04 GMT

I have a PA4020 running 5.0.3 and I have a PA5020 running 4.1.8.

The 4020 running 5.0.3 is affected by the "unknown" issue.

The 5020 running 4.1.8 seems to be unaffected... categories seem to be working fine.

Re: All sites registering as "unknown"

Retired Member — Wed, 20 Mar 2013 13:52:07 GMT

we had that issue with 5.0.2 at 2 seperate sites.

Re: All sites registering as "unknown"

ericgearhart — Wed, 20 Mar 2013 13:59:35 GMT

I'm assuming you work for PA... do you guys have appliances running 5.0 that you can try to recreate this issue with?

I have a PA4020 running PANOS 5.0.3 with URL Filtering update 4058 that exhibits this issue (only custom URL categories show up with the correct category).

I also have a PA5020 running PANOS 4.1.8 with URL Filtering update 4058 that does not exhibit this issue.

Re: All sites registering as "unknown"

mmartin — Wed, 20 Mar 2013 13:59:56 GMT

Applied a Brighcloud and Antivirus update early this morning with no issues. I hope PaloAlto will let us know the root cause analysis outcome. Thanks all for your information posting here and opening support cases. I tend to dig here first.

Re: All sites registering as "unknown"

s996kingsm — Wed, 20 Mar 2013 16:55:43 GMT

I am having the same issue and have a case open

Re: All sites registering as "unknown"

dyang — Wed, 20 Mar 2013 20:34:55 GMT

Yes, we are actively troubleshooting this and I'll update this thread once we have some more details to share.

Thanks again for everyone's patience.

--Doris

Re: All sites registering as "unknown"

ericgearhart — Wed, 20 Mar 2013 20:57:25 GMT

I just updated to URL Filtering content release 4059, and did a 'debug software restart device-server' followed by a 'clear url-cache all' and the issue seems to be resolved.

Re: All sites registering as "unknown"

dyang — Thu, 21 Mar 2013 01:09:25 GMT

Hi everyone,

Just a minor update - we're still investigating the root cause of the issue and why it seems to have only affected PAN-OS 5.0.x and not PAN-OS 4.1.x customers (if you're using PAN-OS 4.1 and see this issue, please let us know). In the meantime, it appears that the key to restoring functionality is to restart the device server - you should not need to clear your entire cache.

More updates as they come.

Thanks,

Doris

Re: All sites registering as "unknown"

afiq — Thu, 21 Mar 2013 14:46:43 GMT

one of our PAN is using 4.1.9 ....only affected on 1 single domain detected as unknown

Re: All sites registering as "unknown"

bmellem — Thu, 21 Mar 2013 17:45:25 GMT

We are seeing this as well at 5.0.3, clearing the URL cache hasn't fixed anything so we are opening a ticket. We are on Brightcloud 4059, so we are up to date on that.

Re: All sites registering as "unknown"

dyang — Thu, 21 Mar 2013 18:39:42 GMT

Hi bmellem,

As mentioned before, please restart your device server in order to resolve this issue.

Thanks,

Doris

Re: All sites registering as "unknown"

cloughr — Fri, 22 Mar 2013 19:00:31 GMT

This happened to us today, running 5.0.2. Resetting the cache fixed it. I would like to know the cause when found..