cache usage after licence expire

[Abdul_Razaq]

Hi Community,

What happens if URL and Threat licence expire in paloalto?. From PA kb ( https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CloiCAC ) , i am able to understand that the cache will be used until it expires, but what is the cache timeout duration for URl and threat ?.

I am able to see the local db category information of particular URL, but in traffic log, it shows as licence-expired. Does this mean PA is no longer uses this catogary information and cache is already timed out?

[reaper]

When threat license expires you will no longer get threat updates, but the old signatures will keep getting enforced (there is no cache for threats)

you can see how a URL is categorized in cache by running > test url <url>

[Abdul_Razaq]

Hi @reaper
Usually how long PA will use url category cache?. I hope even after cache timeout happens, it won't be removed from db.
When I do test url, I am able to see category, but it shows cache expires in 0 seconds. Does it means cache is timed out, and PA won't be using this category information ?

[reaper]

A cache entry stays for 1800 seconds and can get refreshed by a new request
Once the cache timeout is expired, the record can get replaced by a newer request
If you still see it, it is not replaced yet and policy cmwill apply its category

[Abdul_Razaq]

Hi @reaper ,

In my case, the licence is expired, so after the 1800 seconds, it cannot have a new request to cloud and get updates,so it will expire soon right?.

for example,

if i put test facebook.com, it gives me following output.

facebook.com social-networking (Base db) expires in 0 seconds
facebook.com cloud-unavailable (Cloud db)

And i feel PA if not considering this cache, even if had a profile to block social networking catogary, it bypasses. So does that mean that 'expires in 0 seconds' indicates it expired already and it is stale, but it is not removed ?

Thanks in advance

[Abdul_Razaq]

Thanks@reaper , 

I have seen below KB as well,

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXoCAK

So it looks like the cache is timed out but not removed.