External Dynamic List is not getting refreshed - HTTP error 302
2985
Created On 07/25/23 15:18 PM - Last Modified 02/14/24 00:54 AM
Symptom
- When a change or update is done on an existing EDL hosted on an external server, the Firewall is not able to refresh the updated EDL.
- This causes the desired traffic not being processed correctly.
- As the firewall is not able to refresh the updated EDL, it will use an existing old copy of EDL.
configd.log (less mp-log configd.log)
Error: ebl_fetch_url_from_remote_libcurl(pan_cfg_ebl.c:2617): EDL vsys1:Malware_IP_list_EDL curl_easy_perform passed, http error(302)
Error: ebl_verify_fetched_copy(pan_cfg_ebl.c:2932): EDL entry(0x559016d14000, 0x5590750d6000, 0x559081184e00 vsys1/Malware_IP_list_EDL,
1, 1 ip) No valid entries found. No error
Error: ebl_update_local_file(pan_cfg_ebl.c:3247): EDL entry(0x559016d14000, 0x5590750d6000, 0x559081184e00
vsys1/Malware_IP_list_EDL, 1, 1 ip) Unable to fetch external dynamic list. No error. Using old copy for refresh.
Environment
- Palo Alto Networks firewall or Panorama.
- Supported Pan-OS
- External Dynamic List (EDL)
Cause
- The firewall is receiving redirect message from the server.
- This can be seen in the configd logs (less mp-log configd.log) as "HTTP error 302"
Resolution
- Redirections (http error 302) are not supported by Palo Alto firewalls on EDL configuration.
- Reconfigure the Server to ensure no redirects are sent to Palo Alto Firewalls.
Additional Information
Refer also: Unable To Fetch External Dynamic Lists (EDL) Due To A Timeout Or Connection Error