Match the exact PAN-OS message to its cause, check the interface that performs the fetch, and verify that a loaded list is actually used in policy.
Open the Palo Alto setup guideWhen a Palo Alto EDL is not working, run Test Source URL, then read the exact System log message. Check DNS and the effective service route, require HTTP 200, validate the TLS chain and certificate profile, verify authentication, inspect list formatting, then confirm capacity and that a policy rule references the EDL.
Test first: open the free 200-entry sample. No signup is required.
Copy the complete message from Monitor > Logs > System. Similar-looking errors have different causes.
| Exact PAN-OS message | What it means | What to check | Source |
|---|---|---|---|
EDL(<Edl name>) Unable to fetch external dynamic list. HTTP response code said error Using old copy for refresh. |
The web server returned something other than HTTP 200. Palo Alto documents HTTP 500 as one example. | Correct the source server or request path so the EDL URL returns HTTP 200 directly. | Palo Alto Networks KB |
URL access error |
Test Source URL can show this when the requested resource returns HTTP 404. The test is also not a reliable authentication test. | Verify the complete Source URL and confirm that the server provides the requested file. If client authentication is enabled, validate the committed list with a refresh instead of relying on this test. | 404 KB; authentication-test KB |
EDL server certificate authentication failed. A local copy of associated external dynamic list will be used... Reason: unable to get local issuer certificate |
PAN-OS could not validate the server certificate. The cause Palo Alto documents for this message is a configured URL that redirects, because the EDL fetch does not follow redirects. A certificate profile missing the root or intermediate CA is the other cause to rule out. | Use the final URL without a redirect. Verify that the EDL certificate profile contains the matching root and intermediate CA certificates. | Palo Alto Networks KB |
Unable to fetch external dynamic list. Failure when receiving data from the peer. Using old copy for refresh |
Palo Alto documents this with a failed EDL server-certificate check, including an incomplete or self-signed certificate chain. | Inspect the complete chain presented by the server, import the required CA certificates, add them to a certificate profile, and assign that profile to the EDL. | Palo Alto Networks KB |
Unable to fetch external dynamic list. Timeout was reached. |
The interface selected by the EDL service-route hierarchy could not complete the connection. | Check the External Dynamic Lists route first, then the Palo Alto Networks Services route. Confirm routing and policy for the selected source interface. | Palo Alto Networks KB |
Unable to fetch external dynamic list. Couldn't resolve host name. Using old copy for refresh. |
The EDL hostname did not resolve from the firewall’s fetch path. | Check DNS reachability and resolution from the interface selected by the effective service route. If all EDL hostnames fail together, check the shared DNS and route path first. | Palo Alto Networks LIVEcommunity |
Unable to fetch external dynamic list. Maximum file size (6.5MB) exceeded.. Using old copy for refresh |
The source file exceeded the documented maximum in the cited KB. | Reduce the file below the supported size. Check the value enforced by the firewall with the documented command below. | Palo Alto Networks KB |
Unable to fetch external dynamic list. No error. Using old copy for refresh., with http error(302) in configd.log |
The EDL server redirected the request. Palo Alto documents that redirects are not supported for this EDL fetch. | Put the final, direct file URL in the Source field and configure the server not to redirect that request. | Palo Alto Networks KB |
Test reachability, inspect what PAN-OS parsed, and force one refresh while you watch the job and System logs.
Open Objects > External Dynamic Lists, edit the list, and select Test Source URL. Palo Alto says this verifies that the firewall can connect to the server. It does not verify that server authentication succeeds.
In the EDL object, open List Entries and Exceptions. The List Entries tab shows the imported entries and provides a filter for an IP address, domain, or URL. Check Manual Exceptions as well when one expected item is missing.
These PAN-OS operational commands show the parsed list and request an on-demand refresh:
request system external-list show type ip name <name>
request system external-list refresh type ip name <name>
show jobs allPalo Alto’s EDL enforcement workflow uses the show command to review a list; confirm that it holds the entries you expect. After a manual refresh, use show jobs all to find the EDL refresh result, then check Monitor > Logs > System for its detailed message.
Select Objects > External Dynamic Lists > List Capacities, or run:
request system external-list list-capacities
show system state filter cfg.general.max-edl-ip
show system state filter cfg.general.max-edl-ip-filesizeThe first output compares entries currently used in policy with total capacity. The other commands show the IP-entry and IP-file-size values enforced on that firewall.
A successful test from one path does not prove that a scheduled refresh uses the path you expected.
By default, a PAN-OS firewall retrieves an external dynamic list through the management interface. Palo Alto documents this service-route order (the KB was written for PAN-OS 8.1, so confirm it on your release):
Review the setting at Device > Setup > Services > Service Route Configuration. Set a custom route only when the management path cannot reach or resolve the EDL server, or when the design requires a dataplane source interface.
If a physical dataplane interface is selected, verify its route, DNS path, security policy, and access to the EDL destination. Palo Alto documents refresh failures where the selected source traffic was denied even though Test Source URL succeeded.
Use the certificate chain presented to the firewall, not only the leaf certificate visible in a browser.
For an HTTPS source, Palo Alto directs admins to select a Certificate Profile that contains root and intermediate CA certificates matching the server’s certificates. Missing intermediates can produce unable to get local issuer certificate or self signed certificate in certificate chain.
Do not point the EDL at a short link, login page, or redirecting URL. Palo Alto documents failures for HTTP 302 and other responses that are not HTTP 200. Put the direct text-file URL in the Source field.
PAN-OS client authentication for an EDL is basic HTTP authentication on an HTTPS source. An incorrect username or password causes client authentication to fail. Palo Alto also warns that Test Source URL does not test successful authentication and is not supported as a validation method for an EDL with client authentication.
(eventid eq tls-edl-auth-failure) for server-authentication failures and (eventid eq edl-cli-auth-failure) for client-authentication failures.
A successful download only creates or updates an object. A policy must reference that object and match the traffic.
Palo Alto states that an EDL must be referenced in a supported rule or profile before its entries are enforced. For an IP EDL, use it as a Source or Destination Address in the appropriate Security policy rule. Commit after you add the list to the rule.
Check the Security rule order and test which rule matches the flow. Palo Alto’s EDL enforcement workflow places the list in a Security rule and then directs admins to verify the matching Traffic log or run a Security Policy Match test under Device > Troubleshooting.
Entries count toward capacity only when their EDL is used in policy. If the model’s maximum is exceeded, PAN-OS generates a System log and skips the entries beyond the limit. Check List Capacities and the CLI list details. See the separate Palo Alto EDL limits reference.
Palo Alto says an EDL must contain entries. An empty list cannot be refreshed, so PAN-OS continues using the last information it retrieved. To stop using a list, remove its reference from the rule or profile instead of publishing a blank file.
Open List Entries and Exceptions and inspect Manual Exceptions. An exception must exactly match the list entry. Palo Alto does not support excluding one IP address from inside a listed IP range.
PAN-OS parses an IP list as a text file containing only IP-type entries.
show system state filter cfg.general.max-edl-ip-filesize to inspect the platform value.192.0.2.10/32
198.51.100.0/24
203.0.113.10-203.0.113.25
192.0.2.44/32 ticket-1234The values above use documentation-only address ranges as examples. They are not a threat feed.
Once EDL fetching and enforcement work, a focused feed can block known sources before they reach GlobalProtect.
ThreatListPro is a plain-text IP EDL with one IPv4 address or CIDR per line. Single IPs are written as /32. The customer URL format is:
https://api.threatlistpro.com/v1/YOUR_API_KEY/blocklist.txtThe endpoint uses HTTPS with a public CA certificate, returns HTTP 200 for a valid request, and requires no authentication beyond the API key in the URL. An invalid or revoked key returns HTTP 403, which PAN-OS logs as an HTTP response code error while it keeps using the old copy. Set the PAN-OS refresh interval to Hourly.
The feed covers 5.4M+ IPv4 addresses in a few thousand entries, so compare that with your model’s List Capacities before you add it. It is checked for new attackers every 6 hours. Its source is real attacks on live production Palo Alto GlobalProtect VPN portals in the US.
Follow the Palo Alto GlobalProtect setup guide for policy placement. See EDL URL options for sample and paid feed URLs.
Start with Test Source URL, then check Monitor > Logs > System for the complete EDL message. The usual checkpoints are the effective service route, DNS, HTTP status, redirects, the TLS certificate chain, client authentication, file format, file size, and capacity. Force a refresh with request system external-list refresh type ip name <name>.
PAN-OS could not retrieve the new file and retained the last successfully retrieved copy. Palo Alto says the firewall continues using that information when the web server is unreachable. Fix the current fetch error and confirm a successful EDL refresh job instead of assuming the old copy is current.
Use the final URL without a redirect, inspect the complete certificate chain presented by the EDL server, and assign an EDL certificate profile containing the matching root and intermediate CA certificates. Palo Alto documents both redirects and certificate-chain problems as causes of this message.
Palo Alto documents this result when the source returns HTTP 404, so verify the full file path and that the server provides the requested resource. Test Source URL only tests reachability and does not prove successful server authentication. It is also not a supported validation method for an EDL using client authentication.
PAN-OS requires the EDL request to return HTTP 200. Palo Alto specifically documents URL access error with HTTP 404 and the broader fetch error with non-200 responses. Check the exact path and the server’s access controls, then make the direct EDL URL return the text file with HTTP 200 and no redirect.
Inspect Objects > External Dynamic Lists > List Entries and Exceptions and run the CLI show command. Check invalid entries, type mismatches, file size, capacity, and Manual Exceptions. Do not publish a blank file to disable an EDL: Palo Alto says an empty list cannot refresh, so the last retrieved information remains in use.
ThreatListPro covers 5.4M+ IPv4 addresses and is checked for new attackers every 6 hours. Monthly is $9.99 with a 14-day free trial and no card needed. Yearly is $100. Enterprise is $49.99/month. Paid plans have a 14-day money-back guarantee.
Start a 14-day free trial Or test 200 entries first: free, no signupThreatListPro provides a standard IP blocklist feed compatible with firewalls that support external lists.
Continue with the setup guide or review how EDL objects and capacity work.