How does the PAN-DB URL lookup work when it matches an expired URL on MP/DP?

The URL lookup on the Palo Alto Networks firewall is performed for its first match in the following order.

1. Custom URL categories
2. External dynamic lists (EDLs)
3. Predefined URL categories

Each URL in DP (data plane) and MP (management plane) has its own expiration period assigned by the PAN-DB core. This expiration period cannot be changed by administrator.

URL Query in DP

If the URL look-up matches an expired URL in DP:

1. The DP cache responds with the expired category and the firewall uses it for its traffic.
2. The DP sends a request to MP to request categorization of the URL.
3. Once it gets response from MP the URL gets updated synchronously in  DP.

URL Query in MP

If the URL check on the MP determines that the URL has expired:

1. MP cache responds to DP with the expired category.
2. The MP sends a request to the cloud to request categorization of the URL.
3. Once it gets response from the cloud, MP will update its own cache and also send updated response to DP.

To test a URL category in DP, use the following command:

To test a URL category in MP, use the following command:

For example: