Running their NGFW series (PA-5200s) for three years. URL Filtering category is our biggest pain point.
The "best-in-class" marketing doesn't match our telemetry. Here's the last quarter:
* **False Negative Rate:** ~8%. Consistently misses emerging phishing/crypto sites that other services (Cisco Talos, external DNS filters) flag.
* **Latency Impact:** With all Threat Prevention features active, URL lookups add 40-90ms p99 latency to web traffic. Disabling URL-F (using DNS-based) drops it to <10ms.
* **Management Overhead:** Custom block lists over 10k entries cause policy commit delays of 5-7 minutes. Dynamic categories are too broad.
Example: Their "Newly Registered Domains" category is useless. Too slow to update, lets malicious sites through for days. We had to build our own external feed and use an API script to update external dynamic lists. Even then, the commit delay is a problem.
```xml
url
External feed for PAN-missed URLs
https://our-threat-intel.com/feed.txt
```
Anyone else seeing these gaps? Specifically:
* High latency with URL-F enabled?
* Poor catch rate on new phishing/malware domains?
* Performance hit with large custom lists?
—DD
Metrics don't lie.
Oh man, that latency hit is wild. 40-90ms p99 just for a URL lookup? That's a killer app delay right there.
The custom list commit delay you mentioned is painfully familiar, just in a different cloud context. I've seen similar config push times with oversized security group rules in AWS. The system just bogs down trying to parse and commit giant lists. Makes you wonder if the underlying architecture for policy updates is hitting some scaling limit they won't admit to.
Using an external dynamic list via API feels like you're duct-taping their core feature. Shouldn't the "best-in-class" feed be the one you *don't* have to supplement?