Built-in External Dynamic Lists not visible in Panorama

[DSBIII]

I am trying to create policies in Panorama (9.1.12-h3) using the built-in External dynamic lists (Palo Alto Networks - Bulletproof, Palo Alto Networks - HIgh Risk IP Addresses, etc.) but i do not see them under the destinations in the policy.  I can log into the firewalls and see the dynamic lists there but not from Panorama.  I tried googling and searching the live community but still no luck.  The only thing i am not sure of is the licenses for Panorama.  I understand you need a threat prevention license on the firewall to see the lists but is there also a threat prevention license for Panorama?

[PavelK · Accepted solution]

Thank you for the post @DSBIII

the EDL in Panorama is available after you install Antivirus content update. Please navigate to: Panorama > Dynamic Updates > Then install: "Applications and Threats" and "Antivirus", then EDL will be there.

Kind Regards

Pavel

[DSBIII]

This was a misunderstanding on my part.  The Applications/Threats were listed but the Antivirus and Wildfire was not until I hit check now button.  Once i installed the Antivirus update on Panorama, I was able to see the list and push out the policy with the dynamic lists as expected.

[noclss2000]

I'm running into the same issues. However the AV/Threat updates are current on Panorama (AV from 6/8/25 and Threat from 6/5). 

I think I had ran into this before on another firewall and the AV/Threat updates fixed it. This doesn't seem to be doing the trick this time.

Edit: TAC case opened. I actually found that my secondary panorama was at 100% root directory usage so was going into a 'non-functional (high root partition usage) error. probably not causing this as the primary panorama is fine. TAC case opened for both issues just in case. The other case tried saying disk usage was due to a critical GP vuln even though I don't have GP enabled or even configured. we'll see how good these engineers are and will report back what my cause was for EDLs not populating.

Edit2: Apparently I found some sort of bug regarding this even though TAC wouldn't admit it. Upon talking to TAC, he stated he had another case where they saw similar issues and they just searched for something other than "Palo" or "Alto" and instead searched for "High" and the "Palo Alto Networks - High Risk IPs" showed up. When I asked if this was a bug he said 'no, this is just how they designed it.' I wasn't buying it. I then hopped over to my home pa-220 and showed him I was able to search for the EDLs using search terms 'palo' or even 'lto' in Alto and all the EDLs showed up no issue. This surprised him.