Activate Advanced URL Filtering License
Focus
Focus
Advanced URL Filtering

Activate Advanced URL Filtering License

Table of Contents

Activate
Advanced URL Filtering
License

Follow these steps to purchase and activate your Advanced URL Filtering license.
Where can I use this?
What do I need?
  • Prisma Access (Cloud Management)
  • Prisma Access (Panorama Managed)
  • NGFW (Cloud Managed)
  • NGFW (PAN-OS or Panorama Managed)
Notes:
  • Legacy URL filtering licenses are discontinued, but active legacy licenses are still supported.
  • Prisma Access
    usually include
    Advanced URL Filtering
    capabilities.
The
Advanced URL Filtering
subscription provides real-time URL analysis and malware prevention. In addition to access to PAN-DB, the Palo Alto Networks-developed URL filtering database for high-performance URL lookups, it also offers coverage against malicious URLs and IP addresses.
Advanced URL Filtering
features are available on next-generation firewalls (virtual and on-premises),
Prisma Access (Cloud Management)
,
Prisma Access (Panorama Managed)
, Cloud NGFW for AWS, and Cloud NGFW for Azure. However, next-generation firewalls and Cloud NGFW for Azure require an
Advanced URL Filtering
subscription, while all
Prisma Access
and Cloud NGFW for AWS licenses include
Advanced URL Filtering
capabilities.
To check the compatibility of
Advanced URL Filtering
features with each Palo Alto Networks platform that supports URL Filtering, review URL Filtering Support.

Cloud Managed

If you’re using Panorama to manage
Prisma Access
:
Toggle over to the
PAN-OS & Panorama
tab and follow the guidance there for license activation.
If you’re using
Strata Cloud Manager
, here’s how to validate your URL filtering license and get started:

PAN-OS & Panorama

  1. Obtain and install an
    Advanced URL Filtering
    license.
    The
    Advanced URL Filtering
    license includes access to PAN-DB; if the license expires, the firewall ceases to perform all URL filtering functions, URL category enforcement, and URL cloud lookups. Additionally, all other cloud based updates will not function until you install a valid license.
    1. Select
      Device
      Licenses
      and, in the License Management section, select the license installation method:
      • Retrieve license keys from license server
      • Activate feature using authorization code
    2. Confirm that the
      Advanced URL Filtering
      section,
      Date Expires
      field, displays a valid date.
      When you activate the
      Advanced URL Filtering
      license, your license entitlements for PAN-DB and
      Advanced URL Filtering
      might not display correctly on the firewall — this is a display anomaly, not a licensing issue, and does not affect access to the services. You can update the licenses on the firewall to rectify the display issue by using the following CLI command:
      request license fetch
      .
  2. Download and install the latest PAN-OS content release. PAN-OS Applications and Threats content release 8390-6607 and later allows firewalls operating PAN-OS 9.x and later to identify URLs that have been categorized using the real-time-detection category introduced withx
    Advanced URL Filtering
    . For more information about the update, refer to the Applications and Threat Content Release Notes. You can also review Content Release Notes for apps and threats on the Palo Alto Networks Support Portal or directly in the firewall web interface: select
    Device
    Dynamic Updates
    and open the Release Note for a specific content release version.
    Follow the Best Practices for Applications and Threats Content Updates when updating to the latest content release version.
  3. Schedule the firewall to download dynamic updates for Applications and Threats.
    A Threat Prevention license is required to receive content updates, which covers Antivirus and Applications and Threats.
    1. Select
      Device
      Dynamic Updates
      .
    2. In the Schedule field in the Applications and Threats section, click the
      None
      link to schedule periodic updates.
      You can only schedule dynamic updates if the firewall has direct Internet access. If updates are already scheduled in a section, the link text displays the schedule settings.
      The Applications and Threats updates sometimes contain updates for URL filtering related to Safe Search Enforcement.
Next Steps:
  1. Configure a URL Filtering profile to define your organization’s web usage policies.

Recommended For You