Hi @FWPalolearner ,
Scroll down on this link -> https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resour... and you will see a table of the features in URL and Advanced URL filtering. The 1st line, "URL filtering database" is PAN-DB.
A license expired message is not normal. You may need to "Retrieve license keys from license server" under Device > License.
Yes, you can test URL categorization on the NGFW. Use the "test url" command on the CLI -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClQcCAK. On the bottom of the link it has special PANW URLs you can test for each category.
@TomYoung I deleted the PAN_DB license key via CLI
Now i cant see PAN DB license ; and only see Advanced License which is valid
I tried request license fetch .
On the URL Filtering TAB i see below now
The FW however shows PAN DB is good
(active)> show url-cloud status
PAN-DB URL Filtering
License : valid
Current cloud server : serverlist.urlcloud.paloaltonetworks.com
Cloud connection : connected
Cloud mode : public
URL database version - device : 20211130.20072
URL database version - cloud : 20211130.20072 ( last update time 2021/11/30 05:44:05 )
URL database status : good
URL protocol version - device : pan/2.0.0
URL protocol version - cloud : pan/2.0.0
Protocol compatibility status : compatible
I want to get rid of GUI error showing "License Required for URL filtering to Function"
I bet it's still common some PA firewall still running PANOS 8.1 version but have been renewed/migrated old PAN-DB lic to Advanced URL Lic because the Old PAN-DB lic has been discontinued since last Nov. The "New" A-URL lic has all the PAN-DB lic (functionality) + the Machine-learning function/new EDL when you upgrade to PANOS 9.x upwards.
Here's the steps taken to fixed the PAN-DB lic issue in PANOS 8.1 by the following steps, and A-URL subscription can be shown in WebUI.
1) Manually download the A-URL license file from the customer support portal (Fetch from the WebUI not working)
2) Install the A-URL lic key on your firewall (thru WebUI)
3) Use CLI to remove the old existing (PAN-DB) license
Hope this helps,
**** FYI, the PANOS 8.1 will be end of support by March 2022, it's time to plan for the upgrade. ****
Hi @SeanDeHarris ,
Exactly! I just did the same thing for a customer the other day. They upgraded from URL to Advanced URL. URL is not sold anymore. We are going to see this a lot. Your reply should be marked as the solution. The same process works for 9.1.
I know we had a similar issue and when raising a case with PA TAC they advised to refer to PAN-178194. here is a brief of the reply from PA TAC:
Hope that help all
@SeanDeHarris Thanks for the info - any idea how to automat this ? we have a customer with over 150 devices worldwide so we can't really do this one-by-one...
Yaakov (kobi) H
Hi @Kobiher ,
With regard to automating CLI, you could look into Ansible, Python Parmiko, Expect, etc. Your question probably should be a separate post under this forum -> https://live.paloaltonetworks.com/t5/automation-api-discussions/bd-p/TechnologiesSDKsDiscussions.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!