topic Re: Use onprem hosted EDL from AWS CNGFW in Cloud NGFW for AWS Discussions

Use onprem hosted EDL from AWS CNGFW

Anon1 — Mon, 30 Mar 2026 11:55:26 GMT

Is it somehow possible to load an EDL from a server located in onprem network (not reachable from Internet)? From which interface / IP address does the AWS CNGFW tries to connect to EDL server? Can it make connection from an interface / IP address located in customer VPC? Could not find any documentation for this specific topic.

Re: Use onprem hosted EDL from AWS CNGFW

nikoolayy1 — Fri, 24 Jul 2026 07:41:23 GMT

Why don't you just test it and see if it can?

Is your setup Centralized deployment in Security VPC Cloud NGFW for AWS Centralized Deployments ?

Re: Use onprem hosted EDL from AWS CNGFW

Anon1 — Tue, 28 Jul 2026 14:53:50 GMT

Actually tested it and confirmed by Palo Alto account engineer:

CNGFW AWS does not support EDL loading from customer network. All EDLs must be hosted in public reachable Internet.

CNGFW Azure supports usage of loopback IP in customer VNET for connection to EDL host

Re: Use onprem hosted EDL from AWS CNGFW

nikoolayy1 — Mon, 03 Aug 2026 06:49:37 GMT

What about having Panorama to manage the cloud WAF and have the panorama as a VM on-prem as to fetch the EDL to and a VPN tunnel between on-prem and AWS to be able to push the EDL?

You can then connect it to Strata Cloud Manager Panorama CloudConnector Plugin as to have policies in a single place as Panorama is just the middle man in this case.

Re: Use onprem hosted EDL from AWS CNGFW

Anon1 — Mon, 03 Aug 2026 12:12:00 GMT

We actually used Panorama plugin to manage CNGFW (both AWS and Azure), but for the EDL download it does not matter as this connection is made from the firewall device itself to configured edl host. In case of AWS, only public reachable edl hosts can be used. For Azure, the edl connection can use service connection via vnet interface (this is not possible in AWS).

Re: Use onprem hosted EDL from AWS CNGFW

nikoolayy1 — Tue, 04 Aug 2026 13:22:30 GMT

Maybe then you can limit access on the on-prem fw based on the source IP address (Elastic IP.) that the cloud NGFW in AWS will use to connect to your on-prem server? This way nothing else will will be allowed to reach the on prem feed server. You just need DNS record to a public on-prem ip address probably on a firewall or even router with ACL capabilities.

LIVEcommunity - New Deployment Model: Integrating Cloud NGFW for AWS with Regional NAT Gateway - LIVEcommunity - 1243513

Maybe this limitation comes as the AWS Cloud NGFW is from what I researched based on AWS Gateway Load Balancer setup while the azure cloud NGFW is based on internal and external Azure LB and Palo Alto VM instances between them. Who knows.

Re: Use onprem hosted EDL from AWS CNGFW

Anon1 — Tue, 04 Aug 2026 13:31:22 GMT

Of course there would be options to make onprem EDL host reachable over internet and limit it somehow. But in the end we decided to use self managed VM series anyway. CNGFW had too many limitations and management sacrifices for us.