URLs Classified as Not-Resolved

1. Check the status of the PAN-DB cloud connection.

   Run the show url-cloud status CLI command.

   The Cloud connection field should show connected. If you see anything other than connected, then any URL that does not exist in the management plane cache will be categorized as not-resolved.

   If your firewall is running PAN-OS 12.2.2 or later, check the Connection status and Cloud election status fields for additional detail on the connection state and any errors. If the Connection status field displays disabled, Offline Mode is active.

   To resolve connectivity issues, see PAN-DB Cloud Connectivity Issues.
2. If the cloud connection status shows connected, check the current utilization of the firewall.

   If firewall utilization is spiking, URL requests may be dropped (may not reach the management plane) and will be categorized as not-resolved.

   To view system resources, run the show system resources CLI command. Then, view the %CPU and %MEM columns.

   You can also view system resources on the System Resources widget on the Dashboard in the web interface.
3. Consider increasing the Category lookup timeout (sec) value.

   Increasing the timeout value improves the likelihood that the URL category gets resolved and reduces the frequency of not-resolved URLs in logs.

   1. Select DeviceSetupContent-ID and edit the URL filtering setting.

      You can also update the value using the set deviceconfig setting ctd url-wait-timeout CLI command.
   2. Click OK and Commit your changes.
4. (Optional, PAN-OS 12.2.2 and later) Enable priority queuing for PAN-DB cloud connections.

   Enabling priority queuing increases memory usage. Verify available memory before enabling in resource-constrained environments.

   Priority queuing reduces not-resolved categorizations under high URL lookup volumes. This feature uses weighted queues to ensure the most time-sensitive URL requests, cache misses (URLs not found in the management plane or dataplane cache) and real-time threat detection, reach the PAN-DB cloud first. A firewall reboot is required for this change to take effect.

   Run the following CLI commands:

   • set deviceconfig setting pan-url-db priority-queue yes
   • set deviceconfig setting pan-url-db priority-queue no
5. (PAN-OS 12.2.2 and later, PA-5450, PA-5440, PA-7500, and PA-5500 Series) Verify that multi-threaded PAN-DB cloud connections are active.

   The listed platforms establish multiple parallel connections to the PAN-DB cloud by default, increasing URL lookup throughput. The number of connections varies by platform: PA-5450 and PA-5440 use 2 connections; PA-7500 and PA-5500 Series use 4 connections.

   Run the show url-cloud status CLI command and check the Connection status field, which displays the connection status for each connection.
6. If the connectivity problem persists, contact Palo Alto Networks support.