URL filtering - incosistency with online BrightCloud database

[santonic]

Hello.

A while ago website www.rk-celje.si was recognised as malware-site. But in last couple of months the website seems to be clean and online BrightCloud lookup (URL/IP Lookup | Webroot BrightCloud) recognises it as 'Trustworthy' and categorizes it correctly as 'sports'

But PA device using BrightCloud for URL filtering keeps saying it's malware-site. I've tested it with 2 version of URL filtering database and I've cleaned URL cache every time. Why is the categorisation wrong? Is PA overriding BrightCloud info when they find some malware? If so why don't they report that info back to BrightCloud as well?

xyc@PA-3020> show system info | match url

url-db: brightcloud

url-filtering-version: 4394

xyc@PA-3020> test url www.rk-celje.si

www.rk-celje.si malware-sites (Base db)

xyc@PA-3020>

xyc@PA-3020> show system info | match url

url-db: brightcloud

url-filtering-version: 4405

xyc@PA-3020> test url www.rk-celje.si

www.rk-celje.si malware-sites (Base db)

xyc@PA-3020> clear url-cache all

All entries in URL cache removed!

xyc@PA-3020> test url www.rk-celje.si

www.rk-celje.si malware-sites (Base db)

xyc@PA-3020>

[panos]

How to Handle a URL Miscategorization

[ssharma · Accepted solution]

Hi santonic ,

I had similar issue in my device. I had run following to resolve the issue :

admin@PA> test url www.rk-celje.si

www.rk-celje.si malware-sites (Base db)

>clear url-cache all

>delete dymanic –url host all

>configure

#set deviceconfig setting url dynamic-url yes

#commit

>debug software restart device-server

admin@PA> test url www.rk-celje.si

www.rk-celje.si sports (Base db)

Hope this helps. Thank you.

[santonic]

Restarting device-server solved the issue. Thanx!