Palo Alto Networks Knowledgebase: Long URLs Categorized as Unknown

Long URLs Categorized as Unknown

1756
Created On 02/07/19 23:42 PM - Last Updated 02/07/19 23:42 PM
URL Filtering
Resolution

Symptoms

  • When trying to access a URL, it is denied and the category is classified as Unknown.
  • When performing a CLI test, the correct category is returned.
  • Clearing the local and dynamic cache does not resolve the issue.

Issue

Example:  URL http://creelightingtheledrevolutiontourtampaaug7-repemail.eventbrite.com/ is categorized as Unknown when policy is evaluated.

Test from the CLI returns the correct category:

> test url creelightingtheledrevolutiontourtampaaug7-repemail.eventbrite.com/

creelightingtheledrevolutiontourtampaaug7-repemail.eventbrite.com business-and-economy (Base db)

The output of flow basic indicates the hostlen is too long:

Aug 06 17:29:41 Error: __pan_bc_sc_urlcache_lookup(bc_sc/src/pan_bc_sc_urlcache.c:683): Hostlen too long creelightingtheledrevolutiontourtampaaug7-repemail.eventbrite.com(65)/(1)

Aug 06 17:29:42 Warning: pan_regex_find_trans(pan_regex.c:1549): too many results

Aug 06 17:29:42 Warning: pan_regex_find_trans(pan_regex.c:1549): too many results

Aug 06 17:29:42 Warning: pan_regex_find_trans(pan_regex.c:1549): too many results

Aug 06 17:29:42 Warning: pan_regex_find_trans(pan_regex.c:1549): too many results

Aug 06 17:29:42 Warning: pan_regex_find_trans(pan_regex.c:1549): too many results

Aug 06 17:29:42 Warning: pan_regex_find_trans(pan_regex.c:1549): too many results

Aug 06 17:29:42 Warning: pan_regex_find_trans(pan_regex.c:1549): too many results

Aug 06 17:29:43 Error: __pan_bc_sc_urlcache_lookup(bc_sc/src/pan_bc_sc_urlcache.c:683): Hostlen too long creelightingtheledrevolutiontourtampaaug7-repemail.eventbrite.com(65)/eventclick(11)

Resolution

The dataplane can handle hostnames up to 62 characters for BrightCloud and up to 255 characters for PAN-DB.  Domains that are longer than 62 or 255 characters are categorized as Unknown.

Workarounds

Option 1

Add the URL under the "Custom URL" categories as stated in the document: How To Create Custom URL Categories

Option 2

Specify the URL under the Allow List of the URL Profile.

owner: sdarapuneni



Attachments
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm07CAC&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Attachments
Choose Language