What is the Behavior of the PAN-DB URL Cache After the License Expires?

When the PAN-DB license is allowed to expire, the URLs will be categorized from the existing URL cache stored when the license was valid. However, it may be stale category since the cache may not be current.

After the PAN-DB license expires, the test url CLI command will display the following output:

> test url google.com

google.com search-engines (Base db) expires in 0 seconds

google.com cloud-unavailable (Cloud db)

The message, "expires in 0 seconds", does not mean that the entry is removed from the cache. The status implies that PAN-DB needs to check the cloud server to check for an updated category. If the PAN-DB license has expired, the Palo Alto Networks device can no longer connect to the PAN-DB servers for category confirmation. Therefore, the status will display as expired. If a valid license is applied, the connection to the cloud server can be made and the cached entries will be updated.

owner: kkondo