All sites registering as "unknown"

[mmartin]

Came in today with users screaming that they were getting blocked on all websites.  Finally extracted enough information from them that the category was coming up as “unknown” for all sites…even Google.  Decided it had to be an issue in the URL filtering…updated to latest Brightcloud…no change.

Thought URL cache or dynamic URL cache might be the issue.  SSH-ed into the firewall and issued a clear url-cache all.  That fixed it.  Seems that the URL cache was corrupted.  BTW…I am running 5.0.3 on my PA.

Just thought I would pass that bit of information around in case you encounter that issue, too.

Has anyone else seen this before?

[dyang]

egearhart,

The main issue was the result of a bug in our code - we've added fixes to PAN-OS (5.0.4) as well as content, to resolve this issue.  Version 363 of content contained most of the fixes, but devices would still exhibit some of the behavior mentioned here until a device server restart.  Having the PAN-OS fix in 5.0.4 will prevent this from happening at all.  Since 5.0.4 has yet to be released, it is recommended that any customer who runs into this issue should follow the above steps.

--Doris

[JimGillard]

Now that PAN-OS 5.0.4 has been released, has anyone actually installed it and confirmed that this is no longer an issue?

[cloughr]

l

We have installed the code, and initially we still were seeing some sites stilmisrepresented as unknown. Today, it appears the sites are identified correctly, matching Brightcloud/Webroot. Once this is verified i'll reinstate policies..

[mmartin]

Since I have installed 5.0.4, I have not seen anymore issues with the "unknown" sites.

[mpitogo]

We have a 2020 pair running 5.0.1 and a 5020 pair running 5.0.3 URL 4092 also affected by the bug.  The below commands worked. I'll have to schedule an upgrade to 5.0.4 soon.

clear url-cache all

delete dynamic-url host all

debug software restart device-server

configure

set deviceconfig setting url dynamic-url yes

commit