the short version is that the firewall performs cloud lookups whenever it sees a URL and asks the url filtering database which category a site belongs to, and then decides what to do with the request
the slightly longer version is that there are 2 caches
the dataplane has the list of custom URL categories and a cache of the most popular URLs and their category
the management plane has a much larger cache
when an URL is pegged for URL filtering the DP checks the custom URL categories and exception, then the local DP cache for an entry, if nothing is found it will go ask the management plan for this information. if the MP doesn't have this information it will do a cloud lookup and add the information to its cache (if needed, replacing an older cache entry that hasn't been accessed recently) and let the DP know which category the URL it asked about belongs to
the short version is that the firewall performs cloud lookups whenever it sees a URL and asks the url filtering database which category a site belongs to, and then decides what to do with the request
the slightly longer version is that there are 2 caches
the dataplane has the list of custom URL categories and a cache of the most popular URLs and their category
the management plane has a much larger cache
when an URL is pegged for URL filtering the DP checks the custom URL categories and exception, then the local DP cache for an entry, if nothing is found it will go ask the management plan for this information. if the MP doesn't have this information it will do a cloud lookup and add the information to its cache (if needed, replacing an older cache entry that hasn't been accessed recently) and let the DP know which category the URL it asked about belongs to