URL Categorization suddenly failing as not-resolved for Google search URLs

[Adrian_Jensen]

Is anyone else seeing sudden failures in URL categorization for Google searches? Starting within the last hour or so we are seeing intermittent blocks as not-resolved for search URLs, but not for the Google homepage or any other websites (that I have been able to find so far). Initial error seem to be a HTTP2 compression error to the Google server, followed by not-resolved categorization for any search URLs in the form https://www.google.com/search?q=test.... After a few minutes it works again for a couple tries, then goes back to not-resolved.

URL-cloud database connection is valid and updating normally. No other errors in the PA logs that I can find. Anyone seeing similar?

Edit: Also seeing not-resolved errors for https://www.google.com/maps URLs as well.

[IRCSO_ACollier]

Yes, we started seeing the same thing on any Google Search page as of about 4:40PM Eastern.  Opening a ticket now.

[therealpackerhacker]

We're experiencing the same issue. 

[Adrian_Jensen]

Yes, digging thru my PA logs even deeper. Seeing it started at 13:03 GMT-7 (with a few more intermittent in the 11:30-12:30 range), for URLs:

www.google.com/search?

www.google.com/maps/

www.google.com/recapcha/

www.google.com/?gws_id=

www.google.com/url?

chat.google.com/

accounts.google.com/

play.google.com/

adservice.google.com/

meet.google.com/

analytics.google.com/

mail.google.com/

[huntrepj]

Same here.  Although news.google.com is working. I noticed they have set their TTL to 300 secs.

[IRCSO_ACollier]

Yup.  Ticket is open with support.  Just updated all my filters that had it set to "continue" to "alert" for the time being to avoid user issue calls.  Don't want to leave it that way for long, but at least it works for the moement.

[Adrian_Jensen]

Yeah, I was going to possibly add www.google.com/ to my custom URL category allow filter for the time being. In discussions with our Infosec department. Don't want to leave it that way for long, but it is a simple bypass in the mean time.

[ahameed]

Hi, 

increasing the ncreasing the Category lookup timeout (sec) value to 4 sec resolved it in my case just FYI 
references:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000001Uq8CAE&lang=en_US%E2%80%A... https://docs.paloaltonetworks.com/advanced-url-filtering/administration/troubleshooting/urls-classif...

[fmedranoIII]

thanks going to give this a try. We noticed it was happening with URLs with extended lengths but still under the 256 character limit. Started at the same time yesterday as everyone else.

[ahameed · Accepted solution]

Hi Everyone,

Just an update, engineering team has applied the short-term fix, and you shouldn't see the 'not-resolved' issue constantly, they will be working on permanent fix to fundamentally resolve the Pandb cloud performance issue caused by massive google URL publishing and this fix will be transparent to customers in future. So right now, you can start to undo the workaround implemented ( whitelisted *.google.com URLs, Increase Category lookup timeout (sec) values) if you prefer.

Thanks!

[Adrian_Jensen]

Yes, I saw this a bit earlier today. This morning it was still showing up as "not-resolved" in the local cache:

adrian.admin@PA-HA(active)> test url www.google.com/search

www.google.com/search not-resolved (Base db)expires in 5 seconds
www.google.com/search search-engines low-risk (Cloud db)

adrian.admin@PA-HA(active)> test url-info-host www.google.com/search

www.google.com/search: Doesn't exist in the URL DB

adrian.admin@PA-HA(active)> test url-info-cloud www.google.com/search

BM:
google.com/search,9,5,search-engines,low-risk
google.com/search?q=community+first+foundation+site:coloradogivesfoundation.org%26rlz=1c1gceb%5fenus848us848%26sa=x%26ve  d=2ahukewid0j394j3%5fahxredqihtntcluqran6bagteae%26cshid=1685474396026528,9,5,society,low-risk

Then this afternoon it started showing up as matching the cloud category but doesn't actually exist in the local DB (though it somehow shows as cached with an expiration date in an overall query...). Seems like they pushed something that always cancels local caching for the google.com URLs.

adrian.admin@PA-HA(active)> test url www.google.com/search

www.google.com/search search-engines low-risk (Base db)expires in 1650 seconds
www.google.com/search search-engines low-risk (Cloud db)

adrian.admin@PA-HA(active)> test url-info-host www.google.com/search

www.google.com/search: Doesn't exist in the URL DB

adrian.admin@PA-HA(active)> test url-info-cloud www.google.com/search

BM:
google.com/search,9,5,search-engines,low-risk
google.com/search?q=community+first+foundation+site:coloradogivesfoundation.org%26rlz=1c1gceb%5fenus848us848%26sa=x%26ved=2ahukewid0j394j3%5fahxredqihtntcluqran6bagteae%26cshid=1685474396026528,9,5,society,low-risk

We have undone our temporary fix and so far not seen any issues.

[RoneyRajan123]

Hi Team

Is there any update for this issue, the same issue is faced by on of my customer as well.

Regards

Roney Rajan

[therealpackerhacker]

It happened again. Google.com is not resolving. Looks like it's mostly related to docs.google.com and drive.google.com 

Put temp fix back in place. 

[Adrian_Jensen]

15min or so it was not working for a couple minutes, but has already resolved itself.

I have seen this multiple times over the last few weeks as it will temporarily not resolve for a minute and then work normally again. It looks like PA still has the temporary patch in. Not sure if they are testing patch removal or the patch fails momentarily from time to time.

[RoneyRajan123]

Hi @Adrian_Jensen @ahameed @therealpackerhacker @fmedranoIII 

I am also facing the same issue and affecting the business as well, is there any permanent fix for this issue or not?

My PAN-OS version is 10.1.9-h3

Regards

Roney Rajan