topic Re: EDL problem in General Topics

EDL problem

s_quasar — Sun, 27 Oct 2019 22:30:57 GMT

Hi,

I find this error: EDL(my list) Entry not referenced by a rule.

What does it mean? How can I resolve it?

Re: EDL problem

michelealbrigo — Mon, 28 Oct 2019 09:40:51 GMT

In Objects > External Dynamic Lists you defined an EDL (e.g. you read a list of malicious addresses from some feed), but none of your policies is referencing it. An EDL would probably end up in the Destination Address part of some policy.
Nothing bad, anyway, your firewall is basically just reading an external list of addresses but it's not using that information anywhere.

Re: EDL problem

s_quasar — Mon, 28 Oct 2019 13:37:20 GMT

Hi,

I have a rule with many denies IPs. Is maybe for this reason?

Have I to create a special policy for EDL?

Re: EDL problem

michelealbrigo — Mon, 28 Oct 2019 13:53:57 GMT

No. A rule with a statically defined list of IPs is not an "external dynamic list". Your configuration is pointing to an external source of addresses, it is reading it, but it's not using it. You can either remove the list from Objects > External Dynamic lists or use it in a policy (if appropriate, of course).

Re: EDL problem

s_quasar — Mon, 28 Oct 2019 14:21:49 GMT

How can I use it in a policy? In which part of configuration have I to enter?

Re: EDL problem

michelealbrigo — Mon, 28 Oct 2019 14:24:49 GMT

Source or destination address. Think of it as an Address group.

Re: EDL problem

s_quasar — Mon, 28 Oct 2019 14:48:58 GMT

I thought it was enough to insert the EDL instead we also need the security rule. Thaks a lot! Only one last question. Why in the standard Paloalto EDL do you see all the IPs in detail, while in my personalized rules I don't see IPs? In this manner I can't insert any exceptions.

Re: EDL problem

michelealbrigo — Tue, 29 Oct 2019 08:42:21 GMT

My firewalls exhibit the same behaviour (PanOS 8.1.10), the list is valid, but the GUI shows no addresses in it. Maybe it's a bug?

Re: EDL problem

s_quasar — Tue, 29 Oct 2019 11:01:11 GMT

Yes that's the problem I meant.

Do you know some good lists to use for blocking malicious IPs?

I found http://plonkatronix.com/plonkatronixBL.txt and this URL https://panwdbl.appspot.com/ (I'm investiganting about this).

Re: EDL problem

michelealbrigo — Tue, 29 Oct 2019 13:08:56 GMT

Not really, I'm sorry. It's something I plan to do, but it's low on my priority list at the moment.

Re: EDL problem

rmfalconer — Tue, 29 Oct 2019 16:39:13 GMT

Couple of things to mention.

Is that EDL 'Unassigned IPv4' actually referenced in a policy? If not, it won't show any entries.

If it is referenced, did you check the CLI? you can view entries with: request system external-list show type ip name "Unassigned IPv4"

We do use many of the lists at https://panwdbl.appspot.com/ with no issues. We also keep a custom list that we manage on a local web server.

Re: EDL problem

s_quasar — Wed, 30 Oct 2019 15:31:26 GMT

I have set up the policy but still not presence of IPs in GUI

Re: EDL problem

rmfalconer — Wed, 30 Oct 2019 15:39:41 GMT

Did you check the CLI output?

Re: EDL problem

s_quasar — Wed, 30 Oct 2019 16:06:04 GMT

@michelealbrigo thanks a lot for you help.

If you have a little bit of time can you take a look at these my other problems? (especially about log forwading)
https://live.paloaltonetworks.com/t5/General-Topics/log-to-Kiwi-Syslog/m-p/293687
https://live.paloaltonetworks.com/t5/General-Topics/Decryption-policy-and-SNI/m-p/293676

You help is very appreciated

Re: EDL problem

s_quasar — Wed, 30 Oct 2019 16:46:07 GMT

I've checked now the configuration. Now I can view all the IPs in GUI. Maybe as you say I've checked the list before apply the rule.

Thanks.

Re: EDL problem

KellyM — Wed, 30 Oct 2019 17:08:58 GMT

If your EDL is not referenced in a rule, the firewall will not download the list and this is all you will see:

If you add it to a rule like so:

When you push policy, you will see it followed by an EDL Refresh and you will see the ip's.

Note this is a public list from firehol, https://iplists.firehol.org/

Hope that helps.

Re: EDL problem

michelealbrigo — Thu, 31 Oct 2019 14:37:26 GMT

@s_quasar I've tried to look at those two questions, but I have no experience with Decryption + SNI or with Kiwi Syslog, I'm sorry.

Re: EDL problem

Bharat_Rajwanshi — Sun, 13 Aug 2023 07:42:26 GMT

I hope this link will help in case anyone is still facing this error -

https://www.youtube.com/watch?v=SnQpb-FjHo4

Thanks

Re: EDL problem

PlonkatroniX — Tue, 19 Sep 2023 13:27:40 GMT

Old post but thanks for the backlink.

Plonkatronix has been around since 1999, annoyed at the cost of blacklist services... plonkatronixBL is provided free of charge and always will be.

http://plonkatronix.com/plonkatronixBL.txt