How to Install and Activate PAN-DB for URL Filtering
90633
Created On 09/25/18 17:42 PM - Last Modified 02/19/21 03:21 AM
Symptom
How to Install and Activate PAN-DB for URL Filtering
Environment
- Any PANW Firewall
- Any PAN-OS version
Resolution
The Management Interface is used to connect to the cloud. Please ensure internet connectivity before you proceed.
- License the Palo Alto Networks device for PAN-DB and activate the license on the device.
- Navigate to GUI: Device > Licenses
- Click Retrieve license keys from license server or Activate feature using auth code
- Download the URL DB initial seed file optimized for a specific region:
- Navigate to GUI: Device > Licenses
- Click Download under the Palo Alto Networks URL filtering
- Once downloaded, activate the seed file. This will apply the PAN-DB and initiate a reset of the system.
Note: Before clicking Activate, make sure any unsaved changes to the device configuration are committed to avoid losing any pending changes.
As part of the activation process, PAN-OS will also automatically migrate any existing URL filtering profiles to use the PAN-DB categories. This is done with an auto-commit in the background; no device reboot required. Save your configuration before making any changes, and check URL filtering profiles and security policy.
The following information can be viewed in the system logs:
After the download:
After the activation:
Additional Information
Useful CLI Commands
>show system setting url-database >request url-filtering download paloaltonetworks region <region-name> (Does not apply to PAN-OS 9.0 and later) >request url-filtering download status vendor paloaltonetworks (Does not apply to PAN-OS 9.0 and later) >set system setting url-database paloaltonetworks
Note1: In PAN-OS 9.0, the command "request url-filtering download" only supports BrightCloud URL Filtering
Note2: BrightCloud was removed as a URL filtering vendor starting PAN-OS 9.1. Refer Documentation. Consequently, the commands "request URL filtering download", "request URL filtering revert" and "set system setting url-database" are also removed.