Automating upgrade from PAN-DB license to advanced URL licensing

[Kobiher]

Hello,

 In a previous post in the LiveCommunity forums ( PAN DB vs Advanced ) @SeanDeHarris advised how he manually solved an issue with updating URL Filtering from PAN-DB to Advanced URL filtering usin the article LICENSE ERRORS WHEN MIGRATING FROM PAN-DB URL4 TO ADVANCED URL FILTERING :

Here's the steps taken to fixed the PAN-DB lic issue in PANOS 8.1 by the following steps, and A-URL subscription can be shown in Web

1)            Manually download the A-URL license file from the customer support portal (Fetch from the WebUI not working)
2)            Install the A-URL lic key on your firewall (thru WebUI)
3)            Use CLI to remove the old existing (PAN-DB) license

My question is - what is a good way to automat this as we have a customer with over 150 devices and it just doesn't make sense to fix each device maually ?

 Thank you in advance,

Kobi

[JimmyHolland · Accepted solution]

Hi @Kobiher,

In your choice of scripting/programming language, you could perform the steps from the KB article programmatically for each firewall:

• 1) Use the PAN-OS API to fetch all updated licences:

https://{{host}}/api?key={{key}}&type=op&cmd=<request><license><fetch/></license></request>

• 2) Use the PAN-OS API to delete the PAN-DB license key files:

https://{{host}}/api?key={{key}}&type=op&cmd=<delete><license><key>PAN_DB_URL*</key></license></delete>

• 3) Use the PAN-OS API to perform a "commit force":

https://{{host}}/api/?key={{key}}&type=commit&cmd=<commit><force></force></commit>

• 4) Use the PAN-OS API to check the status of URL filtering:

https://{{host}}/api?key={{key}}&type=op&cmd=<show><url-cloud><status/></url-cloud></show>

Hope this helps