Warning: No Valid DNS Security License

[NavidAlam]

Hi Team,

I am using PA-3220 . We have only Thread Prevention & Wildfire License. Before Anti-Spyware -DNS Signature was using DNS-Snikhole.

Now we change to block we start getting Warning No Vaild DNS Security License . Do we had to buy a license as it is working? 

[TomYoung · Accepted solution]

Hi @NavidAlam ,

The warning indicates you have a policy configured with no license to support it.  Setting the actions to allow in the DNS Polices tab of your Anti-Spyware profile will remove the error.  You cannot modify the default profiles.  If you are using one, you will need to create a custom profile and use it in your security policy instead of the default.

Regards,

Tom

[NavidAlam]

Hi Tom,

We are using 9.1.11 The snapshot you show it is not coming on 9.1.11 ? 

[TomYoung · Accepted solution]

Here is a shot from 9.1.  The Packet Capture must be set to disable also.

[SteveBrown99]

None of these suggestions worked for me, setting all to Allow or Default, did not remove the No Valid DNS Security License. I was able to remove the warning by deleting all botnet-domains from Spyware profile in cli. More details here https://live.paloaltonetworks.com/t5/general-topics/no-valid-dns-security-license-resolved/td-p/5124...

[John_Pinegar]

On newer versions (I'm assuming 10.0.0 and newer), in addition to changing the POLICY ACTION to allow and PACKET CAPTURE to disable, you need to change the LOG SEVERITY to none. I hope this helps someone. (This worked successfully on PAN-OS 10.2.2 & 10.2.3-h2)

[Alan-Hunt]

This did help someone...me! Thanks.