TLDR – Delete expired URL Filtering license once the Advanced URL Filtering license is installed! Or the firewall will show the feature unlicensed and you wont get any URL content updates. For those brave enough, here goes:
Palo Alto no longer support the renewal of the standard URL Filtering license. So I paid the extra for the new Advanced URL Filtering license. The issue I was having is that Advanced URL license was showing in device > licenses but the PAN DB (base) Filtering license was showing as expired. The appliance is on PAN OS 10.0.x and as the license auto downloaded, here is what showed in the license pane:
As the PAN DB license was expired, no content filtering was currently active! It turns out that the Advanced URL Filtering license includes the base PAN-DB entitlement. You don’t have to buy both as Advanced URL Filtering takes its place. Because of this the expired PAN DB license has to be removed so that the Advanced URL Filtering can take its place:
ssh user@10.1.1.1
> delete license key ?
PANDB_URL_Filtering_2012_04_27.key 2012/07/19 08:52:35 0.3K
GlobalProtect_Gateway_2012_04_27.key 2012/07/19 08:52:35 0.3K
GlobalProtect_Portal_2012_04_27.key 2012/07/19 08:52:35 0.3K
Threat_Prevention_2012_04_27.key 2012/07/19 08:52:35 0.3K
> delete license key PANDB_URL_Filtering_2012_04_27.key
You can use the question mark to list the current licenses and then delete the expired one. In the above example I delete the PANDB license (that has expired).
Once I did this the Advanced URL Filtering license entitlement took over. The PANDB update worked and the URL filtering component no longer said it was unlicensed (even though Advanced URL Filtering license was installed).
Note as well that on PAN OS 10.x even with the Advanced URL Filtering license installed the options under the Inline ML settings of a URL Filtering profile are not editable. This is due to bug PAN-178194. The work around is listed here.
There is also a Reddit thread on this issue (which was helpful)here.
Comments