Cortex XDR EDL

[OrkhanM]

Hi,

We want to integrate Cortex XDR EDL with PANGFW EDL. We did everything with this guide -- https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Manage-Exte...

After finishing setup we initiated test url access and it gave us url access error. In this case PANGFW cannot retrieve EDL added ip and domain names. 

Can anyone help? 

[BPry]

@OrkhanM,

I assume that you can access the EDL with the information that you are using on the firewall? Have you verified that the firewalls traffic to the EDL is actually being allowed through the traffic logs?

[OrkhanM]

Hi,

I found the problem reason. Problem was the security policy. After creating EDL list in PANGFW you should create block rule for edl inbound to outbound and outbound to inbound. After creating this rule External Dynamic List will reach to the Cortex XDR's EDL and it will retrieve the data (IP and Domain) to Firewall. In our environment Security Policy didn't configured correctly thats why this situation is happened. 

Thanks for your time.

[Estewanalyst]

Hello,  we had a similar issue to this and applied the EDL IP list to a current EDL policy and it started to populate.  the Test URL error apparently means nothing if it populates.  

However, I do have an ask - now we are unable to add the Domain XDR EDL list to a URL Policy.  It doesn't even show up as an option to add.  Has anyone experienced this?