Many "not-resolved" category in URL Filtering log when using "URL Category" column in Security rules

[paloalto.netfos]

Hi, all,

First, my customer doesn't buy "URL Filtering" license.

I use the "Custom URL Category" in the "URL Category" column at Security rules, as the attachement named "security-rules.png".

https://live.paloaltonetworks.com/servlet/JiveServlet/download/2-5074/security-rules.png

But, I see many category named "not-resolved" in URL Filtering log, as the attachement named "url-filtering.png"

https://live.paloaltonetworks.com/servlet/JiveServlet/download/2-5108/url-filtering.PNG

I check these "not-resolved" URL Filtering logs' detail, all of them doesn't record the rule name that they was matched, but all of them's detail have a threat log in the "Related Logs", as the attachement named "url-filtering_detail.png".

https://live.paloaltonetworks.com/servlet/JiveServlet/download/2-5073/url-filtering_detail.PNG

But, I don't find the related log in Threat log.

My questions are :

- Why does the "not-resolved" URL Filtering logs be generated ?

- Is it my configuration's issue ? or other reason cause it ?

- How to resolve this issue ? or debug this issue ? Do I need open a case to ask for help ?

Please help me,

Thanks,

Sample Wu

[UhMayYeah]

Firewall is unable to resolve these categories.

Can you verify if the URLs termed as not-resolved have been defined in the Custom categories.

With URL-filtering license firewall would contact Cloud (BC /PAN_DB) to resolve the categoty.

Since the firewall does not have URL-filterfing license ,Custom category must have all the URLs in question defined ,explicitly.

Try using wildcards (*) in custom category to include all the sub-domains for these not-resolved categories.

-Ameya

[paloalto.netfos]

Hi, akawimandan,

The URLs termed as not-resolved haven't been defined in any Custom Category, but in normal, these URLs should not be blocked, right ?

In the URL-Filtering logs, these not-resolved logs are blocked, why ? and how to configure to avoid them not be blocked ?

Thanks,

Sample Wu

[UhMayYeah]

Navigate to the URL-filtering security profile being used in the security-rule  and change the action for the category 'not-resolved' to allow.

-Ameya

[paloalto.netfos]

Hi, Ameya,

But in my case, I never use the URL-Filtering security profile in any security rule, I just custom a Custom URL Category and put it in the "Services/URL Categories" column in security rule.

So you mean, I need to create a URL-Filtering security profile and configure it as you said, then put it to the URL-Filtering security profile in all security rules, right ?

Thanks,

Sample Wu

[UhMayYeah]

Security rules in the snap-shot 'security-rules.png' show profile-groups being used which led to this assumption .

Try allowing the category 'not-resolved' in the security-rule.

-Ameya

[paloalto.netfos]

Hi, Ameya,

Thanks for your suggestion, but I might be not configure as you said easily in my customer's environment and policy.

I'll open a case to ask for advanced help.

Thanks again,

Sample Wu