To enable URL filtering on a firewall, you must purchase
and activate a URL Filtering license for one of the supported URL Filtering Vendors and
then install the database for the vendor you selected.
Starting with PAN-OS 6.0, firewalls managed by Panorama
do not need to be running the same URL filtering vendor that is
configured on Panorama. For firewalls running PAN-OS 6.0 or later,
when a mismatch is detected between the vendor enabled on the firewalls
and what is enabled on Panorama, the firewalls can automatically
migrate URL categories and/or URL profiles to (one or more) categories that
align with that of the vendor enabled on it. For guidance on how
to configure URL Filtering on Panorama if you are managing firewalls
running different PAN-OS versions, refer to the Panorama Administrator’s
If you have valid licenses for both PAN-DB and BrightCloud, activating
the PAN-DB license automatically deactivates the BrightCloud license
(and vice versa). At a time, only one URL filtering license can
be active on a firewall.