About zmacharia_PA

There are two types of address groups in the Palo Alto Networks firewalls; dynamic and static. By default, the firewall creates a static address group if you do not explicitly select dynamic. Therefore, you need to add the static element at the time of address group creation. The example below shows an example of creating an address-group named "test-address-group"   [https://<firewall-ip>/api/?type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address-group/entry[@name='test-address-group'] &element=<static /> &key=<yourfirewall-ip-key>]   Hope this explains the mystery. ... View more

Worked great. Thanks! ... View more

Can you please share a high level topology? Something like client -> firewall -> internet. Also, to confirm; is inbound email working and not outbound? Are you doing any url filtering? ... View more

I ran into this issue with all the correct parameters set and also had a security rule defined to reference the EDL. Though the 'Test Source URL' link returned an error, clicking on the 'List Entries And Exceptions' Tab, all the entries were there, so might be worth checking that as well. I am running 8.0.12.   In addition you can also run 'show running security-policy <policy_name>' to validate if the entries have populated. ... View more