A FortiGate Threat Feed (External Connector) of type IP Address commonly holds up to 131,072 entries, with the exact ceiling varying by model and FortiOS version. Each IP or CIDR block counts as one entry, so a subnet covering 256 addresses costs the same as a single host. Check what you are actually using with diagnose test application externalresource 0. Entry-level desktop models are lower, so verify before loading a large aggregated feed.
Fortinet's naming causes half the confusion here. What Palo Alto documents as an External Dynamic List, FortiOS exposes as a Threat Feed under Security Fabric > External Connectors, and the CLI calls it an external resource. All three terms describe the same mechanism: the firewall fetches a plain-text list over HTTPS on a timer and exposes it as an address object you can reference in policy.
What Counts Against the Limit
Three rules decide whether a feed fits:
- One line equals one entry. A single IPv4 address, an IPv6 address, and a CIDR block each consume exactly one entry.
203.0.113.0/24costs one, not 256. - The ceiling is normally per feed. This differs from Palo Alto, where every IP EDL draws from one shared platform pool. On FortiGate each Threat Feed gets its own allowance, though total system memory still bounds how many large feeds you can run at once.
- Malformed lines are dropped, not rejected. The parser skips anything it cannot read, so a file with Windows line endings, comments in an unexpected format, or hostnames mixed into an IP-type feed will silently load fewer entries than the file contains.
Feed Types and Why the Wrong One Loads Nothing
FortiOS supports several external resource types, and picking the wrong one is the most common reason a feed shows zero entries:
| Type | Expects | Used in policy as |
|---|---|---|
| IP Address | One IPv4/IPv6 address or CIDR block per line | Address object in a firewall policy |
| Domain Name | One FQDN or wildcard domain per line | Domain object in DNS or web filtering |
| Malware Hash | One file hash per line | AntiVirus profile |
| Category (FortiGuard) | Fortinet-supplied category feed | Web filter category |
An IP blocklist must be configured as IP Address. Point a Domain Name connector at a list of IPs and FortiOS will parse it, reject every line, and report a healthy connector with nothing in it.
Checking Your Real Usage from the CLI
Two commands answer every capacity and health question. Run them from the CLI in operational mode:
1. All external resources, with entry counts and last update
diagnose test application externalresource 0This lists every configured connector along with its entry count, last update time, and status. It is the fastest way to see whether a feed loaded what you expected. If the count is far below the line count of the source file, you have a parsing problem, not a capacity problem.
2. The parsed contents of one feed
diagnose sys external-resource list <feed-name>Prints the entries the firewall is actually holding. Use it to confirm CIDR blocks survived parsing rather than being discarded.
3. Force an immediate refresh
diagnose sys external-resource refresh <feed-name>Pulls the list now instead of waiting for the timer, so you can re-run the status command and confirm a change at the source took effect.
In the GUI the same information appears on the Security Fabric > External Connectors card, which shows the entry count and last update per connector.
The Refresh Rate Trap
FortiOS defaults the Threat Feed Refresh Rate to 5 minutes. That default is almost always wrong for a blocklist, and it causes two distinct problems.
Set the refresh rate to match how often the source actually changes. ThreatListPro republishes every 6 hours, so a refresh rate between 60 and 360 minutes keeps you current with no wasted requests. If you run a fleet of FortiGates against one feed, stagger the rates so they do not all fetch on the same boundary.
Sizing a Blocklist That Fits
1. Prefer CIDR-aggregated sources
Because a block costs one entry, a source that publishes attacker netblocks instead of individual addresses covers far more of the internet per unit of capacity. ThreatListPro's roughly 2,700 entries expand to more than 5.4 million addresses, using about 2 percent of a 131,072-entry ceiling. Our CIDR calculator shows how many addresses any given block covers.
2. Match the feed to the protected surface
A feed dedicated to SSL-VPN brute force is easy to size, easy to audit, and safe to apply tightly in policy. A general-purpose aggregate mixes spam relays and web scanners into the same object, which makes both sizing and troubleshooting harder.
3. Watch for silent truncation and parse failures
Compare the entry count from diagnose test application externalresource 0 against the number of non-comment lines in the source file after every feed change. A gap means entries were dropped, and nothing in the policy view will tell you.
4. Apply the feed in the right direction
For VPN brute force protection the blocklist belongs on the source of inbound policies covering the SSL-VPN interface. Placing it on the destination of an outbound policy is a common misconfiguration that blocks nothing inbound.
FortiGate vs Palo Alto: The Same Problem, Different Shape
| FortiGate (Threat Feed) | Palo Alto (EDL) | |
|---|---|---|
| Typical IP ceiling | ~131,072 entries | ~50,000 to 150,000+ entries |
| Scope of the limit | Generally per feed | Shared across all IP EDLs on the firewall |
| CIDR counts as | One entry | One entry |
| Default refresh | 5 minutes | Hourly |
| Where configured | Security Fabric > External Connectors | Objects > External Dynamic Lists |
| Status command | diagnose test application externalresource 0 | request system external-list stats type ip name <list> |
The practical conclusion is the same on both platforms: a compact curated list works everywhere, while a large aggregated feed only works on the biggest hardware. The full Palo Alto version of this analysis is in Palo Alto EDL limits, and the step-by-step FortiGate configuration is in our FortiGate SSL-VPN guide.
Frequently Asked Questions
How many IP addresses can a FortiGate external threat feed contain?
Most FortiGate models support up to 131,072 entries in a single Threat Feed (External Connector) of type IP Address. The exact ceiling varies by model and FortiOS version, and entry-level desktop models are lower. Unlike Palo Alto, the limit is generally applied per feed rather than as one shared pool, but total memory across all feeds still bounds what the device can hold.
What is the difference between a FortiGate Threat Feed and an External Dynamic List?
They are the same idea under different vendor names. Palo Alto calls it an External Dynamic List (EDL); Fortinet calls it a Threat Feed or External Connector, configured under Security Fabric > External Connectors. Both fetch a plain-text list of IPs or CIDR blocks over HTTPS on a schedule and make it usable as an address object in policy.
Does a CIDR block count as one entry on a FortiGate?
Yes. A subnet such as 203.0.113.0/24 counts as a single entry even though it covers 256 addresses. This is why a CIDR-aggregated blocklist can cover millions of addresses while consuming only a few thousand entries of feed capacity.
How do I check how many entries my FortiGate threat feed loaded?
Run diagnose test application externalresource 0 to list every configured external resource with its entry count and last-update time. To view the parsed contents of one feed, use diagnose sys external-resource list . The GUI shows the same count in the External Connectors card as "Entries".
Why is my FortiGate threat feed showing 0 entries?
The most common causes are a failed HTTPS fetch (certificate or DNS problem), an incorrect resource type, or a file whose format the parser rejects. Run diagnose test application externalresource 0 to see the last update status, confirm the FortiGate can resolve and reach the URL, and make sure the type is set to Address rather than Domain or Malware Hash.
How often should a FortiGate refresh an external threat feed?
The Refresh Rate is set in minutes and defaults to 5. For a VPN brute force blocklist, anything from 60 to 360 minutes is sensible. ThreatListPro republishes every 6 hours, so polling more often than hourly adds load without adding freshness.
Does ThreatListPro fit within FortiGate threat feed limits?
Comfortably. The list is about 2,700 CIDR-aggregated entries covering more than 5.4 million addresses, roughly 2 percent of a 131,072-entry ceiling. That leaves headroom for FortiGuard feeds and any other connectors you run.