---
sourceDocument: Zurich Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/security-management

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# EDL entry exceptions for Palo Alto Networks Next-Generation Firewall

# EDL entry exceptions for Palo Alto Networks Next-Generation Firewall {#ariaid-title1}

* Release version: Zurich
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

There are restrictions for adding External Dynamic List (EDL) entries to EDLs. If
duplicate, compatibility, or CIDR (Classless Inter-Domain Routing) conflicts exist when you try
to add EDL entries to EDLs, error messages are displayed that help you resolve these
errors.

## Compatibility exception {#paloalto-edl-execptions__section_xxz_1g3_vdb}

Each EDL only accepts entries that are compatible with its observable type. If you create a Domain EDL and you try to attach an IP address observable to it, an incompatible error message is displayed. For example, a domain EDL
can only accept domain observables.

## Duplication exception {#paloalto-edl-execptions__section_jct_jg3_vdb}

An observable can't be activated on multiple EDLs of the same observable type. If a URL observable is already activated on a URL EDL, and you try to activate the same observable on a Phishing URL EDL, a duplication error message
is displayed.

## CIDR (Classless Inter-Domain Routing) exception {#paloalto-edl-execptions__section_dq5_mg3_vdb}

If you attempt to attach a single IP address to an EDL, and this IP address is part of a CIDR observable already on an EDL, a CIDR conflict error is displayed. This error indicates that the single IP address is already included
on the EDL as part of the CIDR observable. For example, <kbd class="ph userinput">192.168.24.25</kbd> is part of the CIDR block <kbd class="ph userinput">192.168.0.0/22</kbd>.
**Previous topic:** [Approve EDL entries for Palo Alto Networks Next-Generation Firewall](https://www.servicenow.com/docs/~ZmX1XVqtf4Y4DQKwYlAuw "An approval process for External Dynamic List (EDL) entries is part of the preconfigured workflow. You approve EDL entries before the entries are activated on EDLs. One you approve the EDL entry, the firewall retrieves the entry, and your observable is blocked from that point forward.")  
**Next topic:** [(Optional) Edit the security tag name for Palo Alto Networks Next-Generation Firewall](https://www.servicenow.com/docs/Q8J7x752jBp2s1FAEOmMKA "If the Display tag check box is selected when you create the External Dynamic List (EDL) record, you can edit the tag names and colors of the security tags. Security tags help you track observables that are already blocked.")