PAN-DB URL Activation Changes to Not Active after Refresh

Issue

PAN-DB URL activation shows 'Yes' after activation, but is seen as 'No' after refreshing the WebGUI page.

1. Device > Licenses > PAN-DB URL Filtering
   Click Download, then Activate.
   
2. The Active field shows 'Yes,' indicating that PAN-DB URL Filtering is active.
   
3. When the page is refreshed, the Active field shows 'No' again, indicating that PAN-DB is not active.
   

Cause

This can occur if there is any issue migrating to the PAN-DB database.

Resolution

1. Check the pan_bc_download.log, which lists an error:

> tail follow yes mp-log pan_bc_download.log

mp\pan_bc_download.log 05-01 17:18:29

Error downloading latest URL database

If a job is stuck, run the following command to determine the ID of the job:

> show jobs all

Look for a job that's not complete and record the Job ID. Then, clear the job:

> clear jobs id <id #>

2. Check the system URL database setting and commit job status.

> set system setting url-database paloaltonetworks

> show jobs all

Job id

# Commit           102

Enqueued ID Type Status Result Completed

2013/05/29 16:15:48 102 Commit FIN FAIL 16:15:49

Warnings:

Details: template > HQTEMPLATE > config > devices > localhost.localdomain > deviceconfig > system > update-schedule > url-database Not available for PAN-DB

Resolve the error by running the following commands (HQTEMPLATE is the example template name shown in the warning message and should be replaced with the actual template name, if different):

> configure

# delete template HQTEMPLATE config deviceconfig system update-schedule url-database

# commit

# exit

After the template has been committed to Panorama, push it to the device.

PAN-DB URL filtering can now be activated.

owner: ukhapre