Applying URL filtering License - schema verification failed

[nickcx1]

Hello,

I have recently re-licensed our filtering and received the Activation Code a new PAN DB URL filtering license. Previously, my 3020 was using a trial Brightcloud. I have activated the license in the PAN portal as I normal would but when I come to Activate the license on the firewall it fails. System log shows the following. Other licenses are ok (threat/av etc)

Any help would be appreciated!

PANOS 5.0.10, PA3020.

[panos]

Hi,

maybe you did it just to be sure.Or can you do again

     > configure
  # delete deviceconfig setting url dynamic-url

Commit the changes and exit to the privilege mode.

Set the URL database to PAN-DB.
> set system setting url-database paloaltonetworks

admin@PA-VM> show system setting url-database
paloaltonetworks

configure

commit force

[HULK · Accepted solution]

Hello Sir,

Could you please follow the KB doc BrightCloud to PAN-DB Migration Process with Panorama for the same.

Also confirm if this is a standalone firewall or managed through Panorama..?

If still the problem persists then follow the mentioned procedure.

Removed the license key, cleared the url cache and removed the latest database

Example:Please verify the valid license for PAN-DB.

> request license info

License entry:

Feature: BrightCloud URL Filtering

Description: BrightCloud URL Filtering

Serial: 0002A100343

Issued: August 29, 2013

Expires: May 02, 2027

Expired?: no

Check the current url-filtering database:

> show system info

...

url-filtering-version: 4179

...

Delete the BrightCloud license key

> delete license key BrightCloud_URL_Filtering_2013_08_29.key

> debug device-server reset brightcloud-database

cfg.latest-url-version: 0

cfg.url-version: 0

Check the current URL filtering database

> show system info

url-filtering-version: 0

>debug software restart device-server

The test url command should not work without a license and database.

> test url google.com

No URL database is loaded.

Please update the result and accordingly will set the next course of action

Hope this helps:

Thanks

[nickcx1]

Hello,

Thank you for the advisory. I think the link provided will fix it. I have a question though:

The firewalls are managed by Panorama, and the policies are centrally deployed. If I move to PAN-DB what will happen to policies that currently use the Brightcloud URL categorisation? For example botnets, abused-drugs or malware-sites. Will those policies with these categories referenced continue to be valid?

Thanks.

[Phoenix]

Hello nickcx1

Here is the answer for the categories mapping between the Brightcloud and Pan-DB

BrightCloud to PAN-DB Category Mapping

For all the 3 categores you are concerned there is an equivalent category in brightcloud.

Thanks !

[nickcx1]

Thank you all - just what I needed to know. Easily better than our support company...