Prisma Access: EDL connection failures with error "Unable to fetch external dynamic list. SSL connect error. Using old copy for refresh."

• Prisma Access Firewalls unable to establish connectivity with EDL URL.
• Traffic does not match the security policy with EDL.
• System logs (GUI: Monitor > Logs > System) display the following error.

EDL(xxxx) Unable to fetch external dynamic list. SSL connect error. Using old copy for refresh.

• Prisma Access - Panorama managed
• Prisma Access - Cloud managed
• EDL (External Dynamic List)

• Prisma Access nodes use the loopback interface IP address (in trusted zone and the IP address is assigned automatically from the configured infrastructure subnet) to connect to the EDL URL to download the EDL.
• This connection (from trusted zone to untrusted zone) is not allowed by default, so the connection fails.

1. Create a security policy to allow the Prisma Access nodes to connect to the EDL URL.
2. Commit the configuration changes.

• source zone - trust
• destination zone - untrust
• source address - the Infrastructure Subnet x.x.x.x/xx
• destination address - the address object with EDL URL FQDN xxxxx.xxx
• App-id - SSL

• Check the EDL connection status:

> request system external-list show type xxxx

• Manually initiate EDL connection:

> request system external-list refresh type xxxx

• Check the EDL refresh job status:

> show jobs all