questions to advanced url filtering

[DVB_Bank]

Hi all,

I renewed licenses and bought the new adv url subscription which is already activated in my customer portal. However, my firewall still has the legacy url license active.

1) Do I need to import the adv url license manually? What happens to the legacy license?

2) Is there any impact when switching from legacy to adv?

3) There is a PA 220 active passive HA setup. I bought the firewalls to different times which means license have different expire dates. I needed to renew licenses for my active fw which means there will be the new adv url license. However, my passive firewall will still run the legacy license.

Is this compatible?

Thank you.

[OtakarKlier]

Hello,

You should just be able to either upload them manually or have the firewall update them.

Device tab -> Licenses (lower left) 

Then just click the " Retrieve license keys from license server" option 

Regards,

[aleksandar.astardzhiev]

Hi @DVB_Bank 

1) Do I need to import the adv url license manually? What happens to the legacy license?

Yes, you still need to "import"/retrieve the activated new license to the firewall. Once the firewall receive the new license it may still show the two in the Device -> Licenses, but actually one the new one will be used

2) Is there any impact when switching from legacy to adv?

Not really. Adv URL filtering gives you access to the ML feature for real-time detections. If you are running PanOS version 9.1 you actually will not benefit from the new license, because these features are not available in this version. If you already running version supporting the new real-time URL detections you still need to "activate" them by using them in URL Filtering profile.

3) There is a PA 220 active passive HA setup. I bought the firewalls to different times which means license have different expire dates. I needed to renew licenses for my active fw which means there will be the new adv url license. However, my passive firewall will still run the legacy license.Is this compatible?

I am not completely sure, but this could be actually a problem. One of the main requirements for two members to create HA is to have same bundle of licenses. I would suggest you to check  with PAN support first, before retrieving the Adv URL license to the active member as it may break your HA.

[DVB_Bank]

Hi Astardzhiev,

thanks for your answer.

regarding 2) on my firewalls I noticed that the url filter category "real-time-detection" is available but when I search url logs in url monitor there aren't any results for that category.

It seems to me that the config for adv url is already present on firewalls but firewalls without the adv url license don't use that feature.

Is that possible?