Error deleting custom URL categories?

[networkadmin]

I created a custom URL category and then tried to delete it and got this on the validate, any ideas please?

Operation           Validate

Status   Failed

Details  member corp-blocking-exclusions is an invalid reference

Invalid block

Invalid url-filtering corp default

Invalid url-filtering

Invalid profiles

Invalid vsys vsys1

Invalid vsys

Invalid configuration for localhost.localdomain

Invalid devices

Any ideas please?

This is on 3.1.1, doesn't appear to matter if the category is set to block/allow or anything else in the URL profiles.

Thanks in advance.

[nrice]

This is a bug that was fixed in 3.1.2.

[networkadmin]

OK I've just upgraded to 3.1.2 and still can't delete these custom categories, when I try to I get:

Delete failed for the following:

corp-blocking-exclusions: The specified object(s) cannot be deleted because of references in one of the following object(s):

custom-url-category url-filtering corp default

I've tried with the url filtering profile set to allow and block for that custom url category and it makes no difference - what am I missing please?

Thanks.

[nrice]

You have to delete any filters using the custom category before you can delete the category.  Similarly, if you have a policy using a filter in which there is a custom category, you have to delete the policy as well.

[networkadmin]

OK sorry can you explain that a bit more step by step please?

I created some URL categories and put some URLs in them.

They automatically show up in all my URL Filtering Profiles, I've not specifically added them.

What exactly do I need to do to delete the custom categories please?

[nrice]

The error message you received indicates that URLs assigned to your custom category were used in block or allow lists in a URL filter called " corp default" .  If you delete the "corp default" URL filter, (won't work to just delete the URLs in the "corp default" filter), you should be able to delete your custom category.

[networkadmin]

So you're saying if I have a URL filtering profile "Corp Default" that had www.domain.com in its allow list section, and I then remove www.domain.com from the allow list and add it to a custom URL category, I can't delete that custom URL category without deleting the entire original "Corp Default" URL profile, which is used on all manner of access rules...?

Have I misunderstood, because if that's correct surely that can't be by design as it just seems plain broken?

I presume I could clone "Corp Default" to at least save a little of the duplication work needed here?

[nrice]

Engineering is looking into allowing the deletion of categories irrespective of references and then automatically cleaning up the references.  In the meantime, you need to delete either the policy or profile in which the URLs listed in the custom category are used.

[networkadmin]

Hi,

Is there any update on if/when this feature will be available please?

Thanks.

[nrice]

Looks like end of this month time frame.

[networkadmin]

Cool thanks.  Sounds like maybe in 3.1.4 then (I'm assuming 3.1.3 is finalised and awaiting release).

[networkadmin]

Are we any nearer to being able to do this please?

[nrice]

Engineering is targeting 3.1.4 due out mid-August, though it is not finalized that it will be in that release.

[jpenalba]

I have a Palo Alto in 3.1.4 and this error still persist.

[SimonT]

https://live.paloaltonetworks.com/t5/general-topics/how-to-remove-a-custom-url-category-from-url-fil...

Issue still persist in 11.1.5! Any ideas on deleting 200+ old custom URL categories?