EDL Performance and Refresh Handling in Panorama

.522643 — Thu, 21 May 2026 08:22:42 GMT

Hello,

We are reviewing an EDL-based IOC blocking architecture using Palo Alto Networks firewalls with Panorama and Cortex XDR.

Currently, IOC blocking is managed mainly with address objects/groups, but we are considering migrating to EDL-only management for operational simplicity and external emergency response through Cortex XDR.

I would appreciate any field experience or best practices regarding large-scale EDL operations.

Questions:

Has anyone operated EDLs at large scale (100K~150K entries)?
Any noticeable impact on performance, memory, CPU, policy lookup, or refresh processing?
If a refresh starts before the previous parsing job finishes, how is this internally handled?
(queueing, overlap prevention, atomic replacement, etc.)
If an EDL object is created in Panorama Shared context, do EDL content updates require Panorama push/commit to firewalls, or are updates automatically reflected after refresh?

Thank you.

Re: EDL Performance and Refresh Handling in Panorama

Raido_Rattameister — Thu, 21 May 2026 13:44:12 GMT

What firewall model are you running?

Different models can support different amount of IPs from EDLs.

topic Re: EDL Performance and Refresh Handling in Panorama in Next-Generation Firewall Discussions

EDL Performance and Refresh Handling in Panorama

Re: EDL Performance and Refresh Handling in Panorama