Migrate Panorama and HA Firewalls from BrightCloud to PAN-DB
Perform this procedure to migrate the URL filtering vendor from BrightCloud to PAN-DB on Panorama and firewalls when the firewalls are deployed in a high availability (HA) configuration. In this example, the active (or active-primary) firewall is named fw1 and the passive (or active-secondary) firewall is named fw2. The migration automatically maps BrightCloud URL categories to PAN-DB URL categories.
- Determine which firewalls require new PAN-DB URL
- Log in to Panorama and select PanoramaDevice DeploymentLicenses.
- Check the URL column to determine which firewalls
have PAN-DB licenses and whether the licenses are valid or expired.A firewall can have valid licenses for both BrightCloud and PAN-DB, but only one license can be active.If you’re not sure whether a PAN-DB URL filtering license is active, access the firewall web interface, select DeviceLicenses, and verify that the Active field displays Yes in the PAN-DB URL Filtering section.
- Purchase a new license for each firewall that does
not have a valid PAN-DB license.In HA deployments, each firewall peer needs a distinct PAN-DB license and authorization code. Palo Alto Networks sends an email containing activation codes for the licenses you purchase. If you can’t find this email, contact Customer Support before proceeding.
- Change the URL filtering vendor to PAN-DB on Panorama.Access the Panorama web interface and perform one of the following tasks:
- Configure the TCP session settings on both firewall HA
peers to ensure sessions that are not yet synchronized will fail
over when you suspend a peer.Log in to the CLI of each firewall and run the following command:
> set session tcp-reject-non-syn no
- Migrate the URL filtering vendor to PAN-DB on each firewall
HA peer.Complete this task on fw2 (passive or active-secondary peer) before fw1 (active or active-primary peer).
- Access the firewall web interface, select DeviceHigh AvailabilityOperational Commands, and Suspend
local device.Performing this step on fw1 triggers failover to fw2.
- Select DeviceLicenses.
- In the License Management section, select Activate
feature using authorization code, enter the Authorization
Code and click OK.Activating the PAN-DB license automatically deactivates the BrightCloud license.
- In the PAN-DB URL Filtering section, Download the seed file, select your region, and click OK.
- Commit and push your configuration changes:
- Access the Panorama web interface.
- Select CommitCommit and Push and Edit Selections in the Push Scope
- Select Device Groups, select the firewall, and click OK.
- Commit and Push your changes to the Panorama configuration and to device groups.
- Access the firewall web interface, select DeviceHigh AvailabilityOperational Commands, and Make
local device functional.When you perform this step on fw1 with preemption enabled on both firewalls, fw1 automatically reverts to active (or active-primary) status and fw2 reverts to passive (or active-secondary) status.
- Access the firewall web interface, select DeviceHigh AvailabilityOperational Commands, and Suspend local device.
- Revert both firewall HA peers to the original TCP session
settings.Run the following command at the CLI of each firewall:
> set session tcp-reject-non-syn yes
Migrate Panorama and non-HA Firewalls from BrightCloud to P...
Migrate Panorama and non-HA Firewalls from BrightCloud to PAN-DB Perform this procedure to migrate the URL filtering vendor from BrightCloud to PAN-DB on Panorama and ...
Enable a URL Filtering Vendor
Enable a URL Filtering Vendor To enable URL filtering on a firewall, you must purchase and activate a URL Filtering license for one of the ...
Select a URL Filtering Vendor on Panorama
Select a URL Filtering Vendor on Panorama URL filtering enables firewalls to monitor and control web access for your users. The policy rules that you ...
Enable PAN-DB URL Filtering
Enable PAN-DB URL Filtering Obtain and install a PAN-DB URL filtering license and confirm that it is installed. If the license expires, the firewall ceases ...
Enable BrightCloud URL Filtering
Enable BrightCloud URL Filtering Obtain and install a BrightCloud URL filtering license and confirm that it is installed. BrightCloud has an option in the URL ...
Problems Activating PAN-DB
Problems Activating PAN-DB Use the following workflow to troubleshoot PAN-DB activation issues. Access the PAN-OS CLI . Verify whether PAN-DB has been activated by running ...
Multi-Category URL Filtering
PAN-DB classifies URLs with multiple categories, so that you can granularly control web access and how users interact with online content. ...
URL Filtering Overview
About URL Filtering Palo Alto Networks URL Filtering protects against web-based threats by giving you a way to safely enable web access while controlling how ...
URL Filtering Vendors
URL Filtering Vendors Palo Alto Networks firewalls support two URL filtering vendors: PAN-DB —The Palo Alto Networks-developed URL filtering database. PAN-DB provides high-performance local caching ...