Difference in URL block categories between panorama and device

[rroberts]

I have 2 PA-2050 being managed by panorama, all running 3.1.6.  I am using the brightcloud url filtering service we paid for and both devices are up to date.

When I do a commit all from panorama it shows "commit all succeeded", however when I check the details of the commit I get a list of messages similar to "member arts is an invalid reference".

I can see that the URL block categories on the devices are obviously different than those listed in the panorama URL filtering security profile in panorama.  I didn't find anything in the admin guide or the release notes.

Can anyone explain this anomoly?

I have attached an image of the default URL block categories on the device as well as the ones pushed to the device by panorama.

[James]

Hi There,

Looks like Panorama booted up with the Surfcontrol Database and not the Brightcloud one.  Please use this command:

admin@Panorama> set system setting url-database brightcloud

You should then get the same categories.

Best Regards

James

[rroberts]

This has resolved my issue.  Thank you James.

[gmoerschel]

Is this the only command that needs to be issued in Panorama to convert and download the Brightcloud categories? Or is it like the firewalls where you activate Brightcloud then do a second step to download the database from Brightcloud.

[rroberts]

gmoerschel,

That is the only command required as there is no activation required on the Panorama appliance.  It is simply used so the URL filtering categories will match what has already been configured on the PA appliances.

[KGC]

I seem to recall we had some issues with the brightcoud database versions being out of sync between Panorama and the firewall as well, or am I imagining this? Brightcloud either changed the names of the categories or added/removed some of them at some point.