Empty EDL PA220 PANOS 10.0

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

Empty EDL PA220 PANOS 10.0

L1 Bithead

Hello

Im doing some tests on PA-220 test unit.

Some story - im using windows 10 with installed debian on WSL.

I've installed apache2 and doing some IP pulls from internet and then hosting it on:
192.168.7.131/steamip2.html
I can access this from my internet browser and i see list of IPs.

After adding edl to palo alto it sais that source is avaible but it only lists 0.0.0.0/32. Ive tried import now or request edl refresh in CLI, still nothing.
My assumptions are

- wrong form of file on apache server, ive tried steamip (only IP listed), steamip.html (<html><body>list of ips</body></html>) didnt work
- I dont have any valid license running on my unit

1 accepted solution

Accepted Solutions

L1 Bithead

Ok i have found thats the problem.

After creating EDL even if you see "source is accessible" with url test button it ALWAYS display 0.0.0.0/32 same in CLI.

Even if you do CLI request system external-list show type ip name EDL_NAME it will show the erorr from previous post.

To fix it you need to have policy rule which is pointing to the EDL. If you do so, after policy push edl will display IPs inside. This is imo stupid and should be changed, unless there is some more deeper logic which i cant understand due to limitation of my small brain:)

admin@Firewall_PA-220> request system external-list show type ip name apache2_steam2

apache2_steam2
Total valid entries : 56
Total ignored entries : 0
Total invalid entries : 0
Total displayed entries : 56
Valid ips:
103.10.124.0/24
103.10.125.0/24
103.28.54.0/23
146.66.152.0/23

 

wjt82918_0-1596884786820.png

 

View solution in original post

7 REPLIES 7

L7 Applicator

Hi @wjt82918 

Try to remove everything except the actual IPs. An EDL should be a simple texfile (without any html tags) with nothing else that the entries that should be imported by the firewall.

L1 Bithead

I've tried this, also dont work. There were only IP/mask, not html tags etc. Still PA can only see 0.0.0.0/32 which is not even hosted in the file

L1 Bithead

wiktor@LAPTOP:~/ipgatherer$ cat /var/www/html/steamip | less

103.10.124.0/24
103.10.125.0/24

wjt82918_0-1596824470765.png

 

Cyber Elite
Cyber Elite

@wjt82918 

 

Normally for EDL  you can config as 

 

Type  IP list

Source complete url

 

Click on Test URL  if it works or not?

 

Regards

MP

Help the community: Like helpful comments and mark solutions.

L1 Bithead

Yes, it says "url is accessible" but still PA dont see anything inside.

I just found out that even

panwdbl.appspot.com/lists/shdrop.txt

or

http://panwdbl.appspot.com/lists/shdrop.txt
Has same issue for me.

admin@Firewall_PA-220> request system external-list show type ip name dyn_bruteforce

dyn_bruteforce
EDL is either not referenced in policy, not downloaded, or empty

Total valid entries : 1
Total ignored entries : 0
Total invalid entries : 0
Total displayed entries : 1
Valid ips:
0.0.0.0/32

 

Even if i try to refresh in CLI.

wjt82918_0-1596883146926.png

Traffic is allowed, rule allows all aplications from mgmt of firewall to internet

wjt82918_1-1596883307175.png

 

L1 Bithead

Ok i have found thats the problem.

After creating EDL even if you see "source is accessible" with url test button it ALWAYS display 0.0.0.0/32 same in CLI.

Even if you do CLI request system external-list show type ip name EDL_NAME it will show the erorr from previous post.

To fix it you need to have policy rule which is pointing to the EDL. If you do so, after policy push edl will display IPs inside. This is imo stupid and should be changed, unless there is some more deeper logic which i cant understand due to limitation of my small brain:)

admin@Firewall_PA-220> request system external-list show type ip name apache2_steam2

apache2_steam2
Total valid entries : 56
Total ignored entries : 0
Total invalid entries : 0
Total displayed entries : 56
Valid ips:
103.10.124.0/24
103.10.125.0/24
103.28.54.0/23
146.66.152.0/23

 

wjt82918_0-1596884786820.png

 

L7 Applicator

Hi @wjt82918 

Ok, got it. The "logic" behind this is that an EDL is only queried if it is used somewhere in your configuration. Unless this isn't the case the EDL will show only 0.0.0.0/32 - but this output definately could be replaced by somethinh like "EDL not in use" or something like that...

  • 1 accepted solution
  • 9212 Views
  • 7 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!