07-20-2023 12:04 AM - edited 07-20-2023 12:06 AM
Yes, I have had this happen before. The default URL Filtering profile action for "unknown" and "not-resolved" is allow, but I suspect many people setup custom URL Filtering profiles to block or continue for additional security. When you upgrade from the PAN-DB database to URL-Cloud database (8.x to 9.x) the database is defaulted and must be repopulated from the cloud. I have also had the URL-Cloud database mysteriously reset and need to re-initialize. Unfortunately when this happens the URLs needed to initialize the database become "not-resolved" and are blocked in your custom URL Filter...
To handle this startup case I added "*.urlcloud.paloaltonetworks.com/" to a Custom URL Category object that always allows in my custom URL Filtering profiles. Since Custom URL Categories are defined outside of URL-Cloud they always resolve, and that allows the *.urlcloud.paloaltonetworks.com update addresses to pass URL Filtering, even when the URL-Cloud database is uninitialized or broken.
