URL filtering enables firewalls to monitor and control web access for your users. The policy rules that you configure to control web access (Security, QoS, Captive Portal, and Decryption rules) reference URL categories. The URL filtering vendor you select on Panorama determines which URL categories are available for referencing in the rules that you add to device groups and push to firewalls.

By default, Panorama uses PAN-DB, a URL filtering database that is tightly integrated into PAN-OS and the Palo Alto Networks threat intelligence cloud. PAN-DB provides high-performance local caching to maximize in-line performance for URL lookups. The other vendor option is BrightCloud, a third-party URL database.

The following topics describe how to change the URL filtering vendor on Panorama or on both Panorama and managed firewalls. You can also change the URL filtering vendor on just the firewalls.