FortiGate external-feed capacity depends on the installed FortiOS release and device class. Before FortiOS 7.4.4, a feed was limited to 10 MB or 131,072 entries. From 7.4.4, entry limits are global and model-based; FortiOS 7.6.4 documents IP-address limits of 300,000, 1,000,000, or 5,000,000 by model class. Check actual loading and truncation with diagnose sys external-resource stats.
Fortinet's naming causes half the confusion here. What Palo Alto documents as an External Dynamic List, FortiOS exposes as a Threat Feed under Security Fabric > External Connectors, and the CLI calls it an external resource. All three terms describe the same mechanism: the firewall fetches a plain-text list over HTTPS on a timer and exposes it as an address object you can reference in policy.
What Counts Against the Limit
Three rules decide whether a feed fits:
- One line equals one entry. A single IPv4 address, an IPv6 address, and a CIDR block each consume exactly one entry.
203.0.113.0/24costs one, not 256. - The scope changed in FortiOS 7.4.4. Earlier releases applied the 10 MB or 131,072-entry limit to each resource. FortiOS 7.4.4 and later use global, model-based limits, so multiple feeds of the same type draw from one capacity.
- Invalid lines are not loaded. The stats output separates valid and error lines, while entries beyond the applicable capacity are truncated. Use a plain-text file with one address, range, or subnet per line; comments begin with
#.
Feed Types and Why the Wrong One Loads Nothing
FortiOS supports several external resource types, and picking the wrong one is the most common reason a feed shows zero entries:
| Type | Expects | Used in policy as |
|---|---|---|
| IP Address | One IPv4/IPv6 address or CIDR block per line | Address object in a firewall policy |
| Domain Name | One FQDN or wildcard domain per line | Domain object in DNS or web filtering |
| Malware Hash | One file hash per line | AntiVirus profile |
| FortiGuard Category | One URL per line | Remote category in web filtering |
An IP blocklist must use the IP Address feed type. Fortinet documents one IPv4 or IPv6 address, address range, or subnet per line for that type. If the entry count is zero or lower than expected, compare the configured type and source-file format with the valid and error counts reported by the CLI.
Checking Your Real Usage from the CLI
Two commands answer every capacity and health question. Run them from the CLI:
1. All external resources, with valid and error line counts
diagnose sys external-resource statsThis lists every configured connector with how many lines it accepted and how many it rejected. It is the fastest way to see whether a feed loaded what you expected. If the count is far below the line count of the source file, you have a parsing problem, not a capacity problem.
2. The parsed contents of one feed
diagnose sys external-address-resource list <feed-name>Prints the entries the firewall is actually holding. Use it to confirm CIDR blocks survived parsing rather than being discarded.
3. Force an immediate refresh
In Security Fabric > External Connectors, select Refresh, or update one named feed from the CLI:
execute update-external-resource <feed-name>For troubleshooting, diagnose test application forticron 8 reloads external resources. Re-run the stats and entry-list commands after the update completes.
In the GUI the same information appears on the Security Fabric > External Connectors card, which shows the entry count and last update per connector.
Threat Feed Errors and Fixes
Start with a targeted refresh and FortiCron debug. The output distinguishes DNS and TCP failures, HTTP errors such as 404, TLS validation problems, and invalid feed entries. Disable debugging when the test finishes.
diagnose debug reset
diagnose debug application forticron -1
diagnose debug console timestamp enable
diagnose debug enable
execute update-external-resource <feed-name>
diagnose debug disable
diagnose debug reset| Status or message | Meaning | Diagnostic command | Fix | Official source |
|---|---|---|---|---|
| Threat feed update failed | The HTTP or HTTPS retrieval, authentication, TLS handshake, response, or parsing stage failed. | |
Read the debug result. Correct the URL or credentials, require a successful HTTP response, and fix invalid lines or the configured feed type. | Fortinet update-failed tip |
| Unavailable with no packets | External-database updates may be disabled; Fortinet documents this when FortiCron and a sniffer show no outbound attempt. | |
Under config system fortiguard, set update-extdb enable. Then refresh and test reachability again. |
Fortinet unavailable-status tip |
| Server not reachable or connector down | The FortiGate cannot resolve or reach the host, uses an unexpected local-out path or source address, or fails HTTPS certificate validation. | |
Confirm DNS resolution and routing. Check interface-select-method, interface, and source IP when required. For HTTPS, confirm the CA is trusted and review server-identity-check (basic or full). Fortinet documents a known "Server not reachable" failure with that check enabled on FortiOS 7.4.5 to 7.4.8 and 7.6.1 to 7.6.3, fixed in 7.4.9 and 7.6.4; upgrade rather than leaving validation off. |
Fortinet connector-down tip |
| 0 entries or invalid resource | The file was retrieved but its entries do not match the selected external-feed type or supported plain-text format. | |
For an IP Address feed, publish one IPv4 or IPv6 address, range, or subnet per line. Review error lines and confirm the URL resolves from the FortiGate. | Fortinet external-feed format |
| External resource contains more entries than supported | The applicable per-resource or global limit was reached; later entries are truncated and not loaded. | |
Use a smaller or CIDR-aggregated feed. Check the limit for the installed FortiOS release and model: accounting changed from per-resource to global in 7.4.4. | Fortinet entry-limit tip |
| Feed is loaded but not blocking | Importing entries creates an object; it does not enforce a block until a supported policy or profile references that object. | |
Reference the IP Address feed as the required source or destination and use the intended policy action. Test a new session. See the FortiGate setup guide and FortiGate SSL-VPN log messages. | Fortinet policy example |
ext-resource-session-check changes that behavior but can increase CPU work.
The Refresh Rate Trap
FortiOS defaults the Threat Feed Refresh Rate to 5 minutes. That default is almost always wrong for a blocklist, and it causes two distinct problems.
Set the refresh rate to match how often the source changes. ThreatListPro republishes every 6 hours, so the recommended polling interval is hourly. Fortinet documents that a scheduled refresh runs between 0 minutes and the configured value, and that on FortiOS 7.6.7 and later a successful retrieval can take several minutes to reach policy enforcement.
Sizing a Blocklist That Fits
1. Prefer CIDR-aggregated sources
Because one subnet occupies one line, a CIDR-aggregated source covers more addresses per entry than a list of individual hosts. ThreatListPro covers 5.4M+ IPv4 addresses in a few thousand IP and CIDR entries. Compare that entry count with your release's global or per-resource limit. Our CIDR calculator shows how many addresses a block covers.
2. Match the feed to the protected surface
A feed dedicated to SSL-VPN brute force is easy to size, easy to audit, and safe to apply tightly in policy. A general-purpose aggregate mixes spam relays and web scanners into the same object, which makes both sizing and troubleshooting harder.
3. Watch for silent truncation and parse failures
Compare the valid line count from diagnose sys external-resource stats against the number of non-comment lines in the source file after every feed change. A gap means entries were dropped, and nothing in the policy view will tell you.
4. Apply the feed in the right direction
For VPN brute force protection the blocklist belongs on the source of inbound policies covering the SSL-VPN interface. Placing it on the destination of an outbound policy is a common misconfiguration that blocks nothing inbound.
diagnose sys external-resource stats after each feed change. On FortiOS 7.4.4 and later, include every feed that shares the global limit; on earlier releases, compare each resource with the 10 MB or 131,072-entry ceiling.
FortiGate vs Palo Alto: The Same Problem, Different Shape
| FortiGate (Threat Feed) | Palo Alto (EDL) | |
|---|---|---|
| IP capacity | Release and model dependent; FortiOS 7.6.4 documents 300,000, 1,000,000, or 5,000,000 | Model dependent; commonly 50,000 or 150,000 total IP entries on PAN-OS hardware |
| Scope of the limit | Global from FortiOS 7.4.4; per resource on earlier releases | Shared total for policy-referenced IP EDLs |
| CIDR counts as | One entry | One entry |
| Refresh | 5-minute default; configurable from 1 to 43,200 minutes | Configurable; verify the default for the installed PAN-OS release |
| Where configured | Security Fabric > External Connectors | Objects > External Dynamic Lists |
| Status command | diagnose sys external-resource stats | request system external-list stats type ip name <list> |
The practical conclusion is the same on both platforms: compare the number of entries—not merely the addresses covered—with the limit for the installed release and model. The full Palo Alto analysis is in Palo Alto EDL limits, and the verified configuration steps are in our FortiGate SSL-VPN guide.
Sources
- Fortinet: External feeds and model-based entry limits
- Fortinet: Configuring an external feed
- Fortinet: Troubleshoot “Threat feed update failed”
- Fortinet: Troubleshoot an unavailable connector
- Fortinet: Manually reload an external threat feed
- Fortinet: External-feed update timing and existing sessions
- Fortinet: Connector routing and source-IP troubleshooting
- Fortinet: Test DNS resolution from the CLI
- Fortinet: External resource contains more entries than is supported
- Fortinet: Threat feed fails with Server not reachable (server-identity-check)
- Fortinet: Use an external IP feed in policy
- Palo Alto Networks: EDL capacities and policy use
Frequently Asked Questions
How many IP addresses can a FortiGate external threat feed contain?
Capacity depends on FortiOS and the device model. Before FortiOS 7.4.4, each external resource was limited to 10 MB or 131,072 entries. From 7.4.4, limits are global and model-based; FortiOS 7.6.4 documents IP-address limits of 300,000 for entry-level, 1,000,000 for mid-range, and 5,000,000 for high-end models.
What is the difference between a FortiGate Threat Feed and an External Dynamic List?
They are the same idea under different vendor names. Palo Alto calls it an External Dynamic List (EDL); Fortinet calls it a Threat Feed or External Connector, configured under Security Fabric > External Connectors. Both fetch a plain-text list of IPs or CIDR blocks over HTTPS on a schedule and make it usable as an address object in policy.
Does a CIDR block count as one entry on a FortiGate?
Yes. A subnet such as 203.0.113.0/24 counts as a single entry even though it covers 256 addresses. This is why a CIDR-aggregated blocklist can cover millions of addresses while consuming only a few thousand entries of feed capacity.
How do I check how many entries my FortiGate threat feed loaded?
Run diagnose sys external-resource stats to list every configured external resource with its valid and error line counts. To view the parsed contents of one feed, use diagnose sys external-address-resource list <feed-name>. The GUI shows the same count in the External Connectors card as "Entries".
Why is my FortiGate threat feed showing 0 entries?
The most common causes are a failed HTTPS fetch (certificate or DNS problem), an incorrect resource type, or a file whose format the parser rejects. Run diagnose sys external-resource stats to see whether lines were rejected, confirm the FortiGate can resolve and reach the URL, and make sure the type is set to Address rather than Domain or Malware Hash.
How often should a FortiGate refresh an external threat feed?
The Refresh Rate is set in minutes and defaults to 5. For a VPN brute force blocklist such as ThreatListPro, set it to 60 minutes (hourly). ThreatListPro republishes every 6 hours, so polling more often than hourly adds load without adding freshness.
Does ThreatListPro fit within FortiGate threat feed limits?
Yes. ThreatListPro covers 5.4M+ IPv4 addresses in a few thousand IP and CIDR entries. Compare that entry count with the global, model-based limit on FortiOS 7.4.4 and later, or the 131,072-entry per-resource limit on earlier releases, and confirm actual loading with diagnose sys external-resource stats.
Why does FortiGate say Threat feed update failed?
Threat feed update failed means FortiGate could not retrieve or process the resource. Enable the documented forticron debug, run execute update-external-resource followed by the feed name, and read the HTTP, DNS, TLS, or parsing result. Confirm the URL, hostname resolution, route or source interface, certificate validation, authentication, response status, and file format.
Why is my FortiGate threat feed loaded but not blocking?
A loaded threat feed does not block traffic by itself. Reference the IP Address external-feed object as a source or destination in a supported policy and set the intended action. Test a new session after the refresh; FortiOS 7.6.7 and later may need several minutes, and existing sessions are not re-evaluated by default.