URL Filtering - Category "Unknown" on Brightcloud lookup in "Adult and Pornography"

[rotra]

In our setup we have a PA-500 (PanOS 4.0.7) where we filter URL's on categories from the Brightcloud database.

We found out a website which is in the "Adult and Pornography" category when we do a lookup on the Brightcloud lookup service.

However in the monitoring tab / URL Filtering in our PA-500 this URL seems to be in the "unknown" category.

We have the latest version of teh URL filtering installed, and some sites I submitted recently are now in the correct category.

However the site keeps in the category "unknown" instead of "Adult and Pornography".

Is there something we can do to solve this ?

[RNC]

From CLI try 'clear url-cache'.

[rotra]

Tried the command to clear the  URL-cache, without any result, the URL keeps in the category "unknown".

[dyang]

Hi, what version of PAN-OS are you using?

[rotra]

I'm using PanOS version 4.0.7 .

[emr_1]

It sounds I have same issue before on my PA5020 v4.0.7.

Are you enabling 'dynamic url filtering' in URL Filtering Profile?

What I saw is if I use 'test url' command, it replies specific category from cloud-db,

though, logged URL traffic shows me 'unknown'

Emr

[dyang · Accepted solution]

Hi guys,

If you both have Dynamic URL Filtering enabled and are still getting URLs categorized as "unknown", please file a ticket with our Support team so we can further investigate.  Assuming that you've already tried to clear the cache via the CLI command, please also include that in your ticket details so we know that you've tried it already.

Thanks,

Doris

[lildeniz]

Hi,

i have same problem with this version

regards

[lildeniz]

Hi

do u have any solution?

[rotra]

I've enabled "Dynamic URL Filtering" and with the "test url" command the url is correctly categorized as "Adult and Pornography".

By now the URL is still categorized as "unknown" in the monitoring.

After this I executed the command "clear url-cache" in the CLI the URL is also categorized as "Adult and Pornography" in the monitoring (and blocked for the visitor).

[lildeniz]

Thanks

[dyang]

@rotra Good to hear that this has been resolved. 

For those of you in a similar situation, please remember that you must enable the setting "Dynamic URL Filtering" to access the BrightCloud database in the cloud for the latest categorization information.  Otherwise, the URL filtering engine will only check for categorization on-device.  If the specific URL you're looking for is not stored on the device, it will return category "unknown".  Keep in mind that information is also cached on the device, so if you enable the dynamic URL filtering setting after you've started, you should use the "clear url-cache" command to clear the cache and force a cloud lookup for the latest categorization.  Otherwise, you will use the cached category until that entry expires in the cache.

Hope this helps,

Doris