Must Panorama and Firewalls Have Matching URL Filtering Vendors?
On any single Panorama management server or firewall,
only one URL filtering vendor can be active: PAN-DB or BrightCloud.
When selecting a vendor for Panorama, you must consider the vendor
and PAN-OS version of the managed firewalls:
PAN-OS 5.0.x and earlier versions—Panorama and the firewalls
require matching URL filtering vendors.
PAN-OS 6.0 or later versions—Panorama and the firewalls do
not require matching URL filtering vendors. If a vendor mismatch
is detected, the firewall maps the URL categories in
the URL Filtering profiles and rules that it received from Panorama
to URL categories that align with those of the vendor enabled on
Therefore, for a deployment in which some firewalls run PAN-OS
6.0 or later and some firewalls run earlier PAN-OS versions, Panorama
must use the same URL filtering vendor as the firewalls that run earlier
PAN-OS versions. For example, if firewalls that run PAN-OS 5.0 use
PAN-DB, and firewalls that run PAN-OS 7.0 use BrightCloud, Panorama
must use PAN-DB.