>
    Strata Copilot
    PAN-DB Cloud Connectivity Issues
    Focus
    Download PDF
    Focus
    1. Home
    2. Advanced URL Filtering
    3. Troubleshooting
    4. PAN-DB Cloud Connectivity Issues
    Download PDF
    Advanced URL Filtering

    PAN-DB Cloud Connectivity Issues

    Table of Contents

    PAN-DB Cloud Connectivity Issues

    Check the cloud connection status and use the troubleshooting checklist to identify and resolve issues between your firewall and the PAN-DB cloud.
    Where can I use this?What do I need?
    • NGFW (Managed by PAN-OS or Panorama)
    Note: Legacy URL filtering licenses are discontinued, but active legacy licenses are still supported.
    PAN-DB cloud connectivity issues can result from PAN-DB cloud server outages, local network problems, blocked connections, or certificate issues. These issues can cause delays in URL lookups and real-time threat detection, URLs to be categorized as not-resolved, and improper policy enforcement for features involving URL categories.
    To ensure connectivity to the PAN-DB cloud, create a dedicated Security policy rule that allows all Palo Alto Networks Management Service traffic. This rule prevents management traffic from being classified as not-resolved and blocked when routed through the data plane.

    Check the Cloud Connection Status

    Run the show url-cloud status CLI command to check connectivity between your firewall and the PAN-DB cloud. PAN-OS 12.2.2 and later provides additional connection details that are critical for many of the troubleshooting steps in the checklist below.
    If the cloud is accessible, the expected response is similar to the following:
    • PAN-OS 12.1 and earlier—The Cloud connection field displays connected.
      show url-cloud status
PAN-DB URL Filtering
License :                          valid
Current cloud server :             serverlist.urlcloud.paloaltonetworks.com
Cloud connection :                 connected
Cloud mode :                       public
URL database version - device :    20200624.20296
URL database version - cloud :     20200624.20296  ( last update time 2020/06/24 12:39:19 )
URL database status :              good
URL protocol version - device :    pan/2.0.0
URL protocol version - cloud :     pan/2.0.0
Protocol compatibility status :    compatible
    • PAN-OS 12.2.2 and later—The Cloud connection and Connection status fields display connected.
      show url-cloud status
PAN-DB URL Filtering
License :                          valid
libcurl resolver :                 threaded
Current cloud server :             pandb3qa.urlcloud.paloaltonetworks.com
Cloud connection :                 connected
...
Last up time : 2025/09/26 12:29:48 to now
Last down time : 2025/09/26 12:03:30 to 2025/09/26 12:29:48
Connection status : connected
Cloud election RTT (ms) : 98
Cloud election status : elected
Cloud connection next steps : N/A
Round trip times (RTT) :
      0 - 100 (ms) : 24
      100 - 200 (ms) : 11
      200 - 500 (ms) : 2
      500 - 1000 (ms) : 1
      1000 - 2000 (ms) : 0
      2000 - (ms) : 0
    If the cloud is not accessible, the expected response is similar to the following:
    • PAN-OS 12.1 and earlier—The Cloud connection field displays not connected.
      show url-cloud status
PAN-DB URL Filtering
License :                          valid
Cloud connection :                 not connected
URL database version - device :    0000.00.00.000
URL protocol version - device :    pan/0.0.2
    • PAN-OS 12.2.2 and later—The Cloud connection and Connection status fields display not connected.
      show url-cloud status
PAN-DB URL Filtering
License :                          valid
libcurl resolver :                 threaded
Current cloud server :             pandb3qa.urlcloud.paloaltonetworks.com
Cloud connection :                 not connected
...
Last up time : 2025/09/26 12:29:48 to now
Last down time : 2025/09/26 12:03:30 to 2025/09/26 12:29:48
Connection status : SSL connect error
Cloud election RTT (ms) : N/A
Cloud election status : SSL connect error
Cloud connection next steps : run 'debug cloud-service-connectivity name pandb' to troubleshoot
Round trip times (RTT) :
      0 - 100 (ms) : 24
      100 - 200 (ms) : 11
      200 - 500 (ms) : 2
      500 - 1000 (ms) : 1
      1000 - 2000 (ms) : 0
      2000 - (ms) : 0
    (PAN-OS 12.2.2 and later) The following table shows descriptions of the show url-cloud status fields and outputs you can use to better understand the cloud connection.
    FieldDescription
    Last up timeTimestamp range of when the cloud connection was last in the "up" state
    Last down timeTimestamp range of when the cloud connection was last in the "down" state
    Connection status
    Current connection status or error details if not connected (per-thread if multi-threading is enabled):
    • connected—The firewall has an active connection to the PAN-DB cloud
    • not connected—The firewall cannot reach the PAN-DB cloud
    • initializing—The cloud connection is being established
    • disabled—Cloud connectivity is disabled; Offline Mode is enabled
    • <error string>—A curl or SSL error occurred; see the Cloud connection next steps field for guided troubleshooting
    Cloud election RTT (ms)Round-trip time of the last cloud election or N/A if not connected
    Cloud election status
    Last cloud election status with error details:
    • elected—Cloud election successful
    • not elected—Cloud election not started yet; firewall is not currently connected to the URL cloud
    • initializing—Cloud connection is in progress
    • <error string>—Indicates a curl error or other election error
    Cloud connection next stepsGuided troubleshooting actions for cloud connectivity issues
    Round trip times (RTT)Cloud latency shown as a bucketized RTT distribution for URL cloud requests

    Troubleshooting Connectivity Issues Checklist

    Use the following checklist to identify and resolve connectivity issues:
    • Is there a Security policy rule that allows management service traffic? Without this rule, management traffic routed through the data plane may be classified as not-resolved and blocked. Create a dedicated Security policy rule that allows all management service traffic.
    • Does the PAN-DB URL Filtering License field show as invalid? Obtain and install a valid PAN-DB license.
    • (PAN-OS 12.2.2 and later) Is Offline Mode enabled? If Offline Mode is active, the Offline Mode checkbox is selected in the UI and the Connection status field in the show url-cloud status output displays disabled. Cloud connections are intentionally blocked when Offline Mode is enabled. This is expected behavior, not a connectivity issue.
    • Does the Protocol compatibility status field show as not compatible? Upgrade PAN-OS to the latest version.
    • Can you ping the PAN-DB cloud server from the firewall? Run the following command to check, replacing ip-address with your management interface IP address:
      ping source ip-address host serverlist.urlcloud.paloaltonetworks.com
    • Is the firewall in a high availability (HA) configuration? Only firewalls in the active, active-primary, or active-secondary state can connect to the PAN-DB cloud. Cloud connectivity is not expected in any other HA state. Run the show high-availability state CLI command on each firewall in the pair to verify.
    • (PAN-OS 12.2.2 and later) Run the show url-cloud status CLI command and check the Cloud connection next steps field for troubleshooting guidance.
    If you still have problems with connectivity between the firewall and the PAN-DB cloud, contact Palo Alto Networks support.

    © 2026 Palo Alto Networks, Inc. All rights reserved.