Palo Alto EDL Limits Explained: Capacity by Model, How to Check It, and How to Stay Under It

A Palo Alto firewall has no per-list EDL entry limit. PAN-OS caps the total IP entries across all IP-type External Dynamic Lists used in policy, and the cap depends on the model: Palo Alto documents 150,000 for PA-3200, PA-5200 and PA-7000 Series and 50,000 for all other models. Each address, range or CIDR block counts as one entry.

Entries beyond the limit are skipped, with only a System log to tell you. To see your own model’s limit and current use, open Objects > External Dynamic Lists and click List Capacities. Sources: Palo Alto’s PAN-OS 10.0 External Dynamic List page and the current Objects > External Dynamic Lists help.

Admins often meet the EDL limit the hard way: they add a popular aggregated blocklist, the commit succeeds, and later they find a System log saying entries were skipped. This guide explains how the limit works so you can size your lists deliberately instead of discovering the ceiling by accident.

What the Palo Alto EDL Limit Actually Is

PAN-OS External Dynamic Lists come in several types: IP address, domain and URL, plus IMEI and IMSI lists for mobile network use. Each type has its own capacity, set per firewall model. The number that matters for blocklists is the IP-type capacity.

Four properties of that limit trip people up:

• It is shared. Palo Alto documents no per-list limit. All IP EDLs used in policy draw from one total, so three 40,000-entry lists in policy need 120,000 entries, more than a 50,000-entry model holds.
• Only lists used in policy count. Entries count toward the limit only if their list is referenced in a policy rule. A list you created but have not used yet does not consume capacity.
• Predefined IP lists do not count. Palo Alto’s documentation says addresses in its predefined IP lists (such as bulletproof hosting and known-malicious IPs) do not count toward the limit.
• It counts entries, not addresses. An address, a range, and a subnet each count as one entry. A single 203.0.113.0/24 line covers 256 addresses for the price of one.

Separately, each firewall supports up to 30 custom EDLs with unique sources across its Security policy rules. The firewall compares the full URL string to decide whether two sources are the same.

Capacity by Model

These are the total IP-address capacities Palo Alto has published for IP-type EDLs:

Do not infer capacity from a generic model table alone. Palo Alto’s official capacity KB documents show system state filter cfg.general.max-edl-ip for the device’s configured maximum, while request system external-list list-capacities reports current policy use and total capacity. The exact commands and documented version coverage appear below.

Size matters most on 50,000-entry models. FireHOL Level 3 was about 11,900 entries and IPsum Level 3 about 19,800 IPs when we checked on October 23, 2026, so either one takes a large share of a 50,000-entry firewall on its own. Many popular free lists are built for servers with large iptables or ipset tables, not for firewall EDL capacity.

What Happens When You Exceed the Limit

Entry capacity and file size are different limits

Entry capacity is the number of parsed entries used in policy. When a firewall reaches its model limit, PAN-OS generates a System log and skips the excess entries while retaining the entries that fit. When Panorama manages a multi-vsys firewall, Palo Alto documents a commit error on Panorama if the device limit is exceeded.

File size is the downloaded text file’s byte size, independent of its entry count. Palo Alto’s KB shows a 6,500,000-byte limit on its PA-3250 example and documents show system state filter cfg.general.max-edl-ip-filesize to read the platform value. If exceeded, PAN-OS cannot fetch the new file and uses the old copy for refresh.

Which entries get skipped depends on list order. Palo Alto’s help suggests ordering your lists so the ones with the most important entries sit at the top and are committed before you reach the limit. Within a large aggregated feed, the tail of the file is usually arbitrary, so you cannot assume the “important” IPs survived.

How to Check Your EDL Usage and Limits

1. Check totals in the web interface. On the firewall, open Objects > External Dynamic Lists and click List Capacities. PAN-OS shows the entries currently used in policy and the firewall’s total capacity for each list type. Palo Alto documents this view in PAN-OS 12.2 help.

2. Check totals and platform limits from the CLI. Palo Alto’s capacity KB is tagged for PAN-OS 9.0 through 11.0 and documents the first two commands below. Its file-size KB documents the third for supported PAN-OS, and the current telemetry reference independently identifies the first as the equivalent capacity command.

request system external-list list-capacities
show system state filter cfg.general.max-edl-ip
show system state filter cfg.general.max-edl-ip-filesize

3. Inspect one IP list. PAN-OS 12.2 CLI documentation includes the stats form, while the PAN-OS 11.1 administration guide documents the show form for reviewing list details and checking whether entries were ignored or skipped. Replace the placeholder with the configured EDL object name.

request system external-list stats type ip name <list-name>
request system external-list show type ip name <list-name>

4. Refresh after correcting the source. Select the list and click Import Now, or use the documented PAN-OS 12.2 command below. Then rerun the capacity and list checks. Refresh failures and capacity warnings are recorded in Monitor > Logs > System; follow the EDL troubleshooting guide if the old copy remains active.

request system external-list refresh type ip name <list-name>

How to Stay Under the Limit

1. Prefer curated lists over aggregated ones

An aggregated feed merges many sources and inherits the entries each of them flags. A curated feed keeps only addresses seen attacking a specific kind of target. For a VPN gateway, a curated VPN brute force list blocks infrastructure seen hitting GlobalProtect portals, while a broad aggregate spends much of its capacity on spam relays and web scanners that may never touch your VPN. Pair any list with the steps in GlobalProtect hardening.

2. Use CIDR-aggregated sources

Because a range counts as one entry, a source that publishes attacker netblocks instead of individual addresses can cover millions of addresses in a few thousand lines. ThreatListPro covers 5.4M+ addresses in only a few thousand entries, well under 10 percent of a 50,000-entry firewall. Our free CIDR calculator shows how many addresses a given block covers.

3. Use the predefined lists freely, and remove unused custom ones from policy

Palo Alto’s predefined IP lists do not count toward the limit, so referencing them costs no capacity. Custom lists count only while a policy rule references them, so take a list you no longer need out of policy and check List Capacities again.

4. Split by purpose, not by source

One list per protected surface (VPN, RDP, SSH, web) is easier to size and easier to audit than one list per vendor. If a list is dedicated to the VPN portal, its policy scope is narrow and its acceptable size is obvious.

5. Watch the system log

Forward System logs to your SIEM or email, or save a filter for EDL capacity warnings. The silent-failure mode is the whole risk, and a short alert setup removes it.

How Other Firewalls Compare

Other firewalls have limits of their own, and they change between releases. On FortiGate, FortiOS 7.2 caps each external IP threat feed at 10 MB or 131,072 entries (FortiOS 7.2.4 threat feeds); FortiOS 7.4 moved to one device-wide limit (300,000 IP entries on 7.4.9), and FortiOS 7.6.3 sets it at 300,000, 1,000,000 or 5,000,000 IP entries for entry-level, mid-range and high-end models (FortiOS 7.6.3 external feeds); see our FortiGate limits guide. pfSense and OPNsense URL Table aliases are bounded by the Firewall Maximum Table Entries setting rather than a fixed per-list count. SonicWall and Sophos have their own limits that vary by model and firmware; check the vendor documentation for yours. The practical conclusion is the same: a compact curated list works everywhere; a large aggregate works only on the biggest hardware. Our Palo Alto GlobalProtect guide and FortiGate guide walk through the vendor-specific setup.

Blocklist Sizes vs Palo Alto EDL Capacity

For the reasoning behind stacking a curated VPN list with a hygiene list, see the 2026 IP blocklist stack and ThreatListPro vs FireHOL.

Sources

• Palo Alto Networks: Uses for External Dynamic Lists in Policy — model capacities, per-firewall totals, policy counting, skipped entries and Panorama behavior.
• PAN-OS 12.2: Objects > External Dynamic Lists — List Capacities, entry counting, evaluation order and Import Now.
• Palo Alto Networks KB: Verify EDL capacity — GUI path and CLI commands for maximum and current usage.
• Palo Alto Networks KB: Maximum EDL file size exceeded — file-size command and old-copy behavior.
• Palo Alto Networks: EDL Capacities metric — official equivalent list-capacities command.
• PAN-OS 12.2 CLI Ops Command Hierarchy — stats, show and refresh syntax.
• PAN-OS 11.1: Enforce Policy on an External Dynamic List — per-list inspection and skipped-entry verification.