How to Migrate from PAN-DB to BrightCloud on the Palo Alto Networks Device

Printer Friendly Page


This document describes how to move from PAN-DB URL Filtering license to BrightCloud URL Filtering license on a Palo Alto Networks device.




  • From the WebGUI, go to Device > Licenses and click "Retrieve license keys from licenses server" under License Management. The BrightCloud Url Filtering section will appear when the BrightCloud licenses have been successfully retrieved.
    Note: In a High Availability (HA) environment, bring the device into the non-functional state in order to change the URL Filtering database.


  • Click "Activate" under the BrightCloud URL Filtering section:



  • Activating the BrightCloud URL Database can take a little while  but the WebGUI will reflect the change from PAN-DB to BrightCloud, as shown below:








The same result can also be achieved using the following CLI command:

> set system setting url-database brightcloud


owner: hshah



   I have to ask why would one want to move from PANDB to BrightCloud?

   I ask because I am planning moving the opposite direction from BrightCloud to PANDB...



There can be instances where someone was still using brightcloud, but got a new RMA or factory defaulted a system, and PANDB was the URL filtering option, and you needed to change it back.

Hi Art,

Panorama 5.0.x supports either Bright cloud enabled firewall or PAN-DB enabled Firewall. It doesnt support both same time.

Customer had Panorama on Bright cloud and Firewall on PAN-DB. Hence he requested to move Firewall on Bright cloud.

For selection on PAN-DB vs Bright Cloud, please contact Sales Engineer.


Hardik Shah