Advanced URL License not showing in Panorama?

[securehops]

I recently renewed some licensing on firewalls.  The URL Filtering subscription changed to Advanced URL Filtering.  On the firewall, under licensing, everything shows fine.

In Panorama, for those firewalls, I noticed after doing a refresh, Pano shows them as not having any URL Filtering license.  Is anyone seeing something similar?

[PavelK]

Thank you for the post @securehops

Have you installed any application content update in Panorama? Advanced URL Filtering License has a dependency on content update. The version 8390-6607 and higher has to be installed. I am not sure whether this could prevent Panorama from fetching the license, but if you have not installed latest content or have installed older than 8390-6607, I would try to install it from: Panorama > Dynamic Updates > Applications and Threats, then refresh license status from: Panorama > Device Deployment > Licenses > Refresh.

Kind Regards

Pavel

[securehops]

Hi @PavelK 

Yes, I am running most recent content update.  I've tried the refresh already but no luck there.   I have a ticket open with support on this.  I'll post back their findings 

[emr_1]

Hi,

Even it is not same as your issue, I have some cases related to Adv. URL Filtering.

Did you try to delete expired PAN-DB (=URL4) license from you device and see how it goes?

Currently, PAN have an issue when you have both expired PAN-DB subscription and valid Adv. URL Filtering at same time.

You might need to request to delete PAN-DB from license server (we (I mean 'users') can't delete it)

[FunkyD]

Hi MIke, experiencing the same issue, what did you do to resolve?

Thanks.

[securehops]

@FunkyD 

I meant to come back and post the solution.  I haven't done it yet but the fix is to upgrade Panorama above 10.x.   In those higher versions, there is a new column for Adv URL, which 9.x doesn't have.

Pretty silly on Palo's part, but this is what they are saying

EDIT:  it is actually 10.1.x that resolves this

[SubaMuthuram]

Hi MikeC,

did they gave any specific document or the release notes which says the particular version has this change, Because one of our customer wanted the document. 

[securehops]

@SubaMuthuram 

It is actually 10.1.x,  

[TomYoung]

Hi @securehops ,

What do the licenses show on the firewalls?  Panorama may be accurately showing the license status on the firewalls, in which case it is not a Panorama issue.  This is a common issue when upgrading from URL Filtering to Advanced URL Filtering, and we have seen and are going to see lots of posts on this issue.  Check out SeanDeHarris's response in this post -> https://live.paloaltonetworks.com/t5/threat-vulnerability-discussions/pan-db-vs-advanced/m-p/463874#....

I also had to do steps 1-3 for a customer of mine to fix the problem.  The steps in the KB article did not work.

Thanks,

Tom

[securehops]

@TomYoung 

The issue is related to Panorama.  Any Panorama version under 10.1, does not have the column for ADV licensing. 

So yes, Panorama is showing accurate licensing for those firewalls with the old licensing, but until we upgrade to Panorama 10.1, we will not see accurate licensing for the firewalls with Adv

[TomYoung]

Thanks @securehops !

I was looking at your 2nd screen shot with it fixed and thought you wanted A-URL to be green.

Tom