Palo Alto Networks Knowledgebase: How to Migrate URL Database from BrightCloud to PAN-DB on HA Devices

How to Migrate URL Database from BrightCloud to PAN-DB on HA Devices

Created On 07/29/19 17:24 PM - Last Updated 07/29/19 17:51 PM
URL Filtering


This document describes how to migrate the URL database from BrightCloud to PAN-DB on a High Availability (HA) pair of Palo Alto Networks devices.



  1. Suspend the Passive/Secondary device.
    Go to Device > High Availability > Operational commands  and suspend local device

         Or from the CLI, execute the command below:

        > request high-availability state suspend

  1. Run the following command on the Passive/Suspended device, if not already set:
    > set session tcp-reject-non-syn no
  2. Retrieve PAN-DB URL licenses from Device > Licenses tab.
  3. Activate the PAN-DB license on the suspended device (or Activate the Database from Device > License tab):
    > set system setting url-database paloaltonetworks
  4. Once activated, make the secondary device functional with the command below. However, this device will come up as "Non-functional" due to DB mismatch with the peer:
    > request high-availability state functional
    Note: When the device is showing as "Non-functional" after issuing the command above, all the interface will still be power down except for HA interface and that is expected.

  5. Suspend the Active/Primary device, this will make the secondary device functional.
    Note: While the device is in non-functional state, the sessions will not be synced. Since non-syn TCP is allowed, most of the existing TCP traffic will not be dropped

  6. Download and activate the PAN-DB license on this device (Steps 3 and 4) .
  7. Both devices are now using PAN-DB, once both devices are functional failover back to the original Primary/Active device.
  8. Revert back to original settings on secondary device:

   > set session tcp-reject-non-syn yes


owner: kalavi

  • Print
  • Copy Link

Choose Language