License errors when migrating from PAN-DB URL4 to Advanced URL Filtering

Update: As of March 2023, some users may be experiencing issues with AURL Renewals presenting similar behavior to the original description in this KB. 

For users currently impacted after activating an AURL renewal, as an interim solution open an Admin case through the customer support portal requesting an update to the PAN-DB URL Filtering expiration date. If an admin case has been opened the below workaround is not required.

The original steps have been maintained below for clarity under the "Previous Workaround" section.

Updated Resolution:

PAN-OS fixes are available for this behavior.
The fix is available in the following software versions. Devices running these software versions or later are not impacted by this issue

• 9.1.16
• 10.0.12
• 10.1.8 
• 10.2.4

Previous Resolution:

Device renewals upgrading to Advanced URL Filtering will include a combination of Advanced URL Filtering, and PAN-DB licenses with the same expiry date. The licenses will be visible in both CSP and locally on the firewall and available after performing a license fetch. This occurs automatically during the license activation for customers and is included with the Advanced URL Filtering purchase.

Note: For new URL filtering purchases (devices which did not previously have a PAN-DB license), only the Advanced URL Filtering license will be attached.   

Example of NGFW expected behavior:

Example of Customer Support Portal expected behavior:

Previous Workaround

Symptom:

After a recent renewal customers with expired PAN-DB licenses (URL4) attempting to activate Advanced URL licenses may receive errors/warnings regarding URL filtering.
(ex: No valid URL filtering license)

Cause:

There is the old PAN-DB license which is already expired still remains on the firewall and the firewall may misidentify there is no a valid license for URL-filtering.

Resolution:

In order to address the issue it is necessary to delete the existing PAN-DB license from the CLI of the firewall. Please note that this action can only be performed by a superuser on the device.  The deletion can be performed by executing the commands below and must be performed on each device manually by the superuser account.

1. Fetch Licenses

 > request license fetch

2. Delete Expired License(s)

   > delete license key PAN_DB_URL*

3. Commit Force (Note: shell prompt will change from '>' to '#' in configure mode)

> configure
# commit force
# exit

     
4. Verify License is valid and cloud is connected

> show url-cloud status