PAN-OS

Obtain and install an Advanced URL Filtering license and confirm that it is installed.
The Advanced URL Filtering license includes access to PAN-DB; if the license expires, the firewall ceases to perform all URL filtering functions, URL category enforcement, and URL cloud lookups. Additionally, all other cloud based updates will not function until you install a valid license.
Select
Device
Licenses
and, in the License Management section, select the license installation method:
Retrieve license keys from license server
Activate feature using authorization code
After installing the license, confirm that the Advanced URL Filtering section,
Date Expires
field, displays a valid date.

When you activate the Advanced URL Filtering license, your license entitlements for PAN-DB and Advanced URL Filtering might not display correctly on the firewall — this is a display anomaly, not a licensing issue, and does not affect access to the services. You can update the licenses on the firewall to rectify the display issue by using the following CLI command:
request license fetch
.
Download and install the latest PAN-OS content release. PAN-OS Applications and Threats content release 8390-6607 and later allows firewalls operating PAN-OS 9.x and later to identify URLs that have been categorized using the new real-time-detection category, identifying URLs classified by advanced URL filtering. For more information about the update, refer to the Applications and Threat Content Release Notes. You can also review Content Release Notes for apps and threats on the Palo Alto Networks Support Portal or directly in the firewall web interface: select
Device
Dynamic Updates
and open the Release Note for a specific content release version.
Follow the Best Practices for Applications and Threats Content Updates when updating to the latest content release version.
Schedule the firewall to download dynamic updates for Applications and Threats.
A Threat Prevention license is required to receive content updates, which covers Antivirus and Applications and Threats.
Select
Device
Dynamic Updates
.
In the Schedule field in the Applications and Threats section, click the
None
link to schedule periodic updates.
You can only schedule dynamic updates if the firewall has direct Internet access. If updates are already scheduled in a section, the link text displays the schedule settings.
The Applications and Threats updates sometimes contain updates for URL filtering related to Safe Search Enforcement.