I think URL filtering could be better to some extent. Improvements could be made in Palo Alto Networks URL Filtering with PAN-DB compared to Sophos. The URL filtering option in Palo Alto gives a very clear vision of the network and the applications using URL filtering. If you assign a user in a group not to access certain URLs, that user should only be allowed to access LinkedIn without running videos. However, deep URL filtering in Palo Alto is not configurable. One user can have access to LinkedIn with video running, while another cannot. They should improve this deep analysis of URL filtering options.
Network Security Engineer at a consultancy with 10,001+ employees
Real User
Top 5
Dec 17, 2024
I am a fan of Palo Alto Networks and do not notice many negative aspects. However, Palo Alto should not be expected to behave exactly like Zscaler since they have other functionalities, like firewall inspections and routing. Some software management-wise scalability features need improvement.
Owner at a tech services company with 1-10 employees
Real User
Top 5
Jul 30, 2024
The main limitation is that it needs a live Internet connection for ongoing updates. URL filtering may not be necessary without Internet connectivity, as you wouldn't be accessing URLs. It's important to note that URL filtering itself doesn't require a separate license. The license you purchase grants access to the URL database and category mappings. If you're comfortable creating and managing your categories, you can use URL filtering without a subscription. Many of the employees, particularly in first-tier customer support, lack experience. This often results in repetitive questions and strict adherence, even if you have completed several steps. The biggest differentiator is its integration with WildFire. When a Palo Alto user worldwide submits a new file to the sandbox for evaluation, antivirus signatures, and URL database entries are automatically generated and propagated if the file is found malicious. While competitors aim to achieve similar results, they have not yet reached the same execution level as Palo Alto.
Network Security Services at ACE Managed Securty Services
Real User
Top 20
Feb 9, 2023
URL Filtering with Palo Alto Networks PAN-DB can help you protect your networks and users from malicious URLs, but it's not perfect. For starters, the database needs to be constantly updated to accurately identify new threats. Additionally, its categorization of websites is sometimes too broad or specific for organizations' needs. Finally, many features like granular controls and multi-category assignments are only available with paid licenses. With all these limitations, it's clear that Palo Alto Networks' URL Filtering could use some improvement. But thankfully, the company is continually striving to improve its offerings to keep networks secure from malicious URLs.
URL Filtering with Palo Alto Networks PAN-DB can help you protect your networks and users from malicious URLs, but it's not perfect. For starters, the database needs to be constantly updated to accurately identify new threats. Additionally, its categorization of websites is sometimes too broad or specific for organizations' needs. Finally, many features like granular controls and multi-category assignments are only available with paid licenses. With all these limitations, it's clear that Palo Alto Networks' URL Filtering could use some improvement. But thankfully, the company is continually striving to improve its offerings to keep networks secure from malicious URLs.
Learn what your peers think about Palo Alto Networks URL Filtering with PAN-DB. Get advice and tips from experienced pros sharing their opinions. Updated: May 2026.
We have been trying make Palo Alto Networks URL Filtering with PAN-DB work with ELK stack. We have had some challenges with that because we are getting limited SNMP. It would be good if it worked better with ELK stack. I'm only able to do it faster when I log into the device and not through Panorama.
Consultant at a tech services company with 11-50 employees
Consultant
Aug 6, 2021
One of the less favorite features is the cost of the solution. For example, ~5K for a PA-820 AND ~$1K EACH *per year* for Premium Support, Threat Prevention, and PANDB URL filtering. We also implement other solutions. We tell customers that if they want to have the best possible perimeter security, they're going to have to pay for it. Some smaller entities don't have the budget for it, so we'll suggest Fortinet or something that has similar but inferior capabilities, but is less expensive.
Consultant at a media company with 51-200 employees
Real User
Jun 5, 2021
It would be ideal if this solution could be a separate product rather than have to have it deploy through a firewall. If it was a separate product, many of our customers would be happier as most just require a URL filtering option. They do not require a firewall. They do not require any threat prevention or anything. If it was a separate product, we could deploy it to branch offices or any of our customer locations in which different firewalls are being used. The solution is a bit expensive.
One way Palo Alto can improve is by offering sandboxing. I don't know if they currently offer a sandboxing feature together with the firewall or not. They should provide secure sandboxing with the firewalls.
Palo Alto Networks URL Filtering with PAN-DB offers advanced URL and content filtering, leveraging App ID technology for precise operations, facilitating straightforward management and integration into existing infrastructures.This tool automates URL category updates, eliminating manual work. Features like credential phishing protection and scalable architecture enhance security, providing comprehensive device capabilities such as firewall management and blacklist/whitelist support. While...
I think URL filtering could be better to some extent. Improvements could be made in Palo Alto Networks URL Filtering with PAN-DB compared to Sophos. The URL filtering option in Palo Alto gives a very clear vision of the network and the applications using URL filtering. If you assign a user in a group not to access certain URLs, that user should only be allowed to access LinkedIn without running videos. However, deep URL filtering in Palo Alto is not configurable. One user can have access to LinkedIn with video running, while another cannot. They should improve this deep analysis of URL filtering options.
I am a fan of Palo Alto Networks and do not notice many negative aspects. However, Palo Alto should not be expected to behave exactly like Zscaler since they have other functionalities, like firewall inspections and routing. Some software management-wise scalability features need improvement.
The main limitation is that it needs a live Internet connection for ongoing updates. URL filtering may not be necessary without Internet connectivity, as you wouldn't be accessing URLs. It's important to note that URL filtering itself doesn't require a separate license. The license you purchase grants access to the URL database and category mappings. If you're comfortable creating and managing your categories, you can use URL filtering without a subscription. Many of the employees, particularly in first-tier customer support, lack experience. This often results in repetitive questions and strict adherence, even if you have completed several steps. The biggest differentiator is its integration with WildFire. When a Palo Alto user worldwide submits a new file to the sandbox for evaluation, antivirus signatures, and URL database entries are automatically generated and propagated if the file is found malicious. While competitors aim to achieve similar results, they have not yet reached the same execution level as Palo Alto.
Support needs to be enhanced.
URL Filtering with Palo Alto Networks PAN-DB can help you protect your networks and users from malicious URLs, but it's not perfect. For starters, the database needs to be constantly updated to accurately identify new threats. Additionally, its categorization of websites is sometimes too broad or specific for organizations' needs. Finally, many features like granular controls and multi-category assignments are only available with paid licenses. With all these limitations, it's clear that Palo Alto Networks' URL Filtering could use some improvement. But thankfully, the company is continually striving to improve its offerings to keep networks secure from malicious URLs.
URL Filtering with Palo Alto Networks PAN-DB can help you protect your networks and users from malicious URLs, but it's not perfect. For starters, the database needs to be constantly updated to accurately identify new threats. Additionally, its categorization of websites is sometimes too broad or specific for organizations' needs. Finally, many features like granular controls and multi-category assignments are only available with paid licenses. With all these limitations, it's clear that Palo Alto Networks' URL Filtering could use some improvement. But thankfully, the company is continually striving to improve its offerings to keep networks secure from malicious URLs.
An area for improvement would be the technical support, which can be slow.
We have been trying make Palo Alto Networks URL Filtering with PAN-DB work with ELK stack. We have had some challenges with that because we are getting limited SNMP. It would be good if it worked better with ELK stack. I'm only able to do it faster when I log into the device and not through Panorama.
One of the less favorite features is the cost of the solution. For example, ~5K for a PA-820 AND ~$1K EACH *per year* for Premium Support, Threat Prevention, and PANDB URL filtering. We also implement other solutions. We tell customers that if they want to have the best possible perimeter security, they're going to have to pay for it. Some smaller entities don't have the budget for it, so we'll suggest Fortinet or something that has similar but inferior capabilities, but is less expensive.
It would be ideal if this solution could be a separate product rather than have to have it deploy through a firewall. If it was a separate product, many of our customers would be happier as most just require a URL filtering option. They do not require a firewall. They do not require any threat prevention or anything. If it was a separate product, we could deploy it to branch offices or any of our customer locations in which different firewalls are being used. The solution is a bit expensive.
Performance monitoring could use improvement.
One way Palo Alto can improve is by offering sandboxing. I don't know if they currently offer a sandboxing feature together with the firewall or not. They should provide secure sandboxing with the firewalls.