All sites registering as "unknown"

[mmartin]

Came in today with users screaming that they were getting blocked on all websites.  Finally extracted enough information from them that the category was coming up as “unknown” for all sites…even Google.  Decided it had to be an issue in the URL filtering…updated to latest Brightcloud…no change.

Thought URL cache or dynamic URL cache might be the issue.  SSH-ed into the firewall and issued a clear url-cache all.  That fixed it.  Seems that the URL cache was corrupted.  BTW…I am running 5.0.3 on my PA.

Just thought I would pass that bit of information around in case you encounter that issue, too.

Has anyone else seen this before?

[ericgearhart]

I'm assuming you work for PA... do you guys have appliances running 5.0 that you can try to recreate this issue with?

I have a PA4020 running PANOS 5.0.3 with URL Filtering update 4058 that exhibits this issue (only custom URL categories show up with the correct category).

I also have a PA5020 running PANOS 4.1.8 with URL Filtering update 4058 that does not exhibit this issue.

[mmartin]

Applied a Brighcloud and Antivirus update early this morning with no issues.  I hope PaloAlto will let us know the root cause analysis outcome.  Thanks all for your information posting here and opening support cases.  I tend to dig here first.

[s996kingsm]

I am having the same issue and have a case open

[dyang]

Yes, we are actively troubleshooting this and I'll update this thread once we have some more details to share.

Thanks again for everyone's patience.

--Doris

[ericgearhart]

I just updated to URL Filtering content release 4059, and did a 'debug software restart device-server' followed by a 'clear url-cache all' and the issue seems to be resolved.

[dyang]

Hi everyone,

Just a minor update - we're still investigating the root cause of the issue and why it seems to have only affected PAN-OS 5.0.x and not PAN-OS 4.1.x customers (if you're using PAN-OS 4.1 and see this issue, please let us know).  In the meantime, it appears that the key to restoring functionality is to restart the device server - you should not need to clear your entire cache.

More updates as they come.

Thanks,

Doris

[afiq]

one of our PAN is using 4.1.9 ....only affected on 1 single domain  detected as unknown

[bmellem]

We are seeing this as well at 5.0.3, clearing the URL cache hasn't fixed anything so we are opening a ticket. We are on Brightcloud 4059, so we are up to date on that.

[dyang]

Hi bmellem,

As mentioned before, please restart your device server in order to resolve this issue. 

Thanks,

Doris

[cloughr]

This happened to us today, running 5.0.2. Resetting the cache fixed it. I would like to know the cause when found..