Incorrect Categorization
Focus
Focus
Advanced URL Filtering

Incorrect Categorization

Table of Contents

Incorrect Categorization

If you believe a website has been incorrectly categorized, follow these steps to verify the URL category and request a URL category change, if necessary.
Where can I use this?
What do I need?
  • NGFW (PAN-OS or Panorama Managed)
Note:
Legacy URL filtering licenses are discontinued, but active legacy licenses are still supported.
Sometimes you may come across a URL that you believe is categorized incorrectly. Use the following workflow to determine the URL categorization for a site and request a category change, if appropriate.
  1. Verify the category in the dataplane by running the following command:
    show running url
    <URL>
    For example, to view the category for the Palo Alto Networks website, run the following command:
    show running url paloaltonetworks.com
    If the URL stored in the dataplane cache has the correct category (computer-and-internet-info in this example), then the categorization is correct and no further action is required. If the category is not correct, continue to the next step.
  2. Verify if the category in the management plane by running the command:
    test url-info-host
    <URL>
    For example:
    test url-info-host paloaltonetworks.com
    If the URL stored in the management plane cache has the correct category, remove the URL from the dataplane cache by running the following command:
    clear url-cache url
    <URL>
    The next time the firewall requests the category for this URL, the request will be forwarded to the management plane. This will resolve the issue and no further action is required. If this does not solve the issue, go to the next step to check the URL category on the cloud systems.
  3. Verify the category in the cloud by running the following command:
    test url-info-cloud
    <URL>
  4. If the URL stored in the cloud has the correct category, remove the URL from the dataplane and the management plane caches.
    Run the following command to delete a URL from the dataplane cache:
    clear url-cache url
    <URL>
    Run the following command to delete a URL from the management plane cache:
    delete url-database url
    <URL>
    The next time the firewall queries for the category of the given URL, the request will be forwarded to the management plane and then to the cloud. This should resolve the category lookup issue. If problems persist, see the next step to submit a categorization change request.
  5. To submit a change request from the web interface, go to the URL log and select the log entry for the URL you would like to have changed.
  6. Click the
    Request Categorization
    change link and follow instructions. You can also request a category change from Palo Alto Networks Test A Site website by searching for the URL and then clicking the
    Request Change
    icon. To view descriptions of each category, refer to Predefined URL Categories.
    If your change request is approved, you will receive an email notification. You then have two options to ensure that the URL category is updated on the firewall:
    • Wait until the URL in the cache expires and the next time the URL is accessed by a user, the new categorization update will be put in the cache.
    • Run the following command to force an update in the cache:
      request url-filtering update url
      <URL>

Recommended For You