EDL object not showing up on dropdown list in policy rule

[Jonathanct]

Hi,

PAN version 9.1.0, no Panorama.

I created two EDL - one of type IP List and one of type Domain List.

Both EDL point to an internal webserver which holds the lists.

Both EDL pass the "Test Source URL" check.

The IP list works fine, we put it an a policy rule and it blocks as excpected.

I tried to create a rule with the Domain list but it doesn't even show in the selection options in the rule, not for source or destination address.

Only the IP list object shows.

Any ideas?

Thanks

[JoergSchuetter]

Hello @Jonathanct 

Since it's a URL based edl, you have to use it with "Service/URL Category".

[Jonathanct]

Hi @JoergSchuetter ,

So both Domain List EDL and URL List EDL should be put in the "Service/URL Category"?

And just to make sure, my blocking rule would look like that:

Source zone: LAN

Source address: any

Dest Zone: WAN

Dest address: any

Application: any

Service/URL Category: my EDL Domain List

Action: Drop

[Jonathanct]

 @JoergSchuetter 

Actually, I just tried what you suggested but I can't see my EDL Domain LIst on the "Service/URL Category" tab as well.

Also, I'll explain why I wanted to doube check about how to create the rule: 

I tried to create a URL Category object which contains only one URL (let's say example.com)  and I put it in a policy rule like this:

Source zone: LAN

Source address: any

Dest Zone: WAN

Dest address: any

Application: any

Service/URL Category: my URL Category Object

Action: ALLOW

(I put it on Allow because for starters, I just wanted to check who is hitting this rule)

When I followed the rule logs I noticed it is getting loads of hits that doesn't relate to example.com

I'm affraid if I put this rule to Block it will block my outgoing traffic.

So same question for thecase of using EDL Domain List.

[Jonathanct]

Source zone: LAN

Source address: any

Dest Zone: WAN

Dest address: any

Application: any

Service/URL Category: my URL Category Object

Action: ALLOW

(I put it on Allow because for starters, I just wanted to check who is hitting this rule)

[gshameem]

 I think for domain based EDL we need to create anti spyware profile and call that profile in security policy.