Managing objects: tags, external dynamic lists, and custom URL categories. These three features let you organise your firewall rules the same way you organise your email inbox with folders and filters – without them, you'd drown in chaos. For the PCNSA exam, understanding how to use these tools is the difference between writing 500 messy firewall rules and writing 20 clean, powerful ones that practically maintain themselves.
Jump to a section
A simple way to picture Managing Objects: Tags, External Dynamic Lists, and Custom URL Categories
Your university library has 10,000 books. Three different systems keep the library manageable. First, the librarian uses coloured stickers on book spines: red stickers for 'checked out', green for 'on hold', yellow for 'reference only', and blue for 'new arrivals'. These stickers are tags – quick labels that tell you something important about the book without opening it. Second, the library has a corkboard by the front door. Every day at 8am, the head librarian pins a printed list: 'Today's Banned Study Rooms: 101, 204' or 'New Quiet Zone: Floor 3'. That printed list is the external dynamic list – it updates automatically from the dean's office each morning, and all security guards read it before starting their shift. Third, the library has its own special categories for book genres that the standard Dewey Decimal system doesn't cover well, like 'Entrepreneurship textbooks for first-years' or 'Advanced quantum physics for PhD students'. These are the custom URL categories – rules you create yourself because the default categories aren't specific enough for your needs. When a security guard sees a red-stickered book, they know not to let it leave the building. When they check the morning list, they know which rooms to keep students out of. And when they shelve a book in the special 'Entrepreneurship' section, they know exactly which table to place it on. The three systems work together to keep the library running smoothly without the guard having to memorise every single rule.
Let's break down each of these three tools one at a time. By the end of this explanation, you'll understand exactly what they do and why they matter for passing the PCNSA exam.
Tags are simply labels you can attach to objects in Palo Alto Networks firewalls. An 'object' could be an IP address, a group of IP addresses, a user, a device, or even another rule. Think of tags like the coloured dots you put on a shared fridge at work – green means 'my food', red means 'expired, don't eat', blue means 'free for anyone'. Tags let you mark objects with labels that help you find them, group them, and apply rules to them more efficiently.
Why do tags exist? Without tags, you might have 400 IP addresses in your firewall, and you'd have no quick way to know which ones belong to the finance department, which ones are temporary contractors, or which ones are known malware servers. Tags solve this by letting you add metadata – data about data – to each object.
How do tags work in practice? You create a tag in the firewall's web interface. You give it a name (like 'Finance_Department' or 'Blocked_Malware') and an optional colour (which makes it easy to spot visually). Then you apply that tag to any object you want – an IP address, a group of IP addresses, a security rule, or a user group. Once tagged, you can:
Filter the firewall's object list to show only objects with a specific tag
Create security rules that apply to all objects carrying a certain tag
Use tags to organise your rule base so other IT staff can instantly understand what each rule does
Tags don't change how packets flow through the firewall. They are purely organisational tools – like labels on files in a filing cabinet.
External Dynamic Lists (EDLs) are one of the most powerful time-saving features in a Palo Alto firewall. An EDL is a list of items (IP addresses, URLs, or domain names) that the firewall automatically downloads from an external source on a schedule you set.
Imagine you're a security guard at a nightclub. Every night, the bouncer at the door gets an updated list of banned customers from the club owner's email. That list changes every day because some people get banned for fighting, and others have their bans lifted. If the bouncer had to type in every banned name by hand each night, he'd be there for hours and would probably make mistakes. The EDL is the automatic email – it arrives fresh every hour, and the bouncer just looks at it.
In firewall terms, the EDL can point to a URL hosted by a threat intelligence company (like Palo Alto Networks' own Unit 42 team) that provides a constantly updated list of known malicious IP addresses. The firewall checks this URL every 5 minutes (or whatever interval you configure) and downloads the latest list. When a new malware command-and-control server is discovered, its IP address gets added to the EDL, and within minutes, all the firewalls using that EDL will start blocking traffic to that IP. No human intervention needed.
Why use EDLs instead of typing IPs by hand? Because the cybersecurity threat landscape changes every minute. By the time you manually type a malicious IP into your firewall, 10 new malicious IPs have appeared. EDLs automate the update process, keeping your firewall current without requiring a person to sit at the console all day.
Custom URL Categories let you define your own categories of websites that the firewall can use for filtering. Out of the box, Palo Alto firewalls come with hundreds of built-in URL categories like 'Social Networking', 'Streaming Media', 'Gambling', and 'Malware'. But real organisations often need categories that don't exist in the default list.
For example, a school might want to block all websites that contain 'homework help' or 'essay writing services' during exam season. That specific collection of URLs doesn't fit neatly into any default category. So the network administrator creates a custom URL category called 'Academic_Dishonesty' and adds the URLs for Chegg, Course Hero, and similar sites. Then they write a firewall rule that blocks all traffic to any URL in that custom category, only during April and May when exams happen.
Custom URL categories give you flexibility. You're not forced to use only what Palo Alto provides – you can extend the system to meet your organisation's specific needs. The key thing to remember is that a custom URL category is just a container for URLs you list yourself. The firewall treats it exactly the same as a built-in category – it just has the URLs you added, not Palo Alto's list.
When these three tools work together, they become a powerhouse. You could create a tag called 'Exam_Time_Blocking', assign it to a security rule that references your custom 'Academic_Dishonesty' URL category, and also use an EDL that contains IPs of known essay-mill servers. One tag, one rule, and two lists do the work that would otherwise require 50 separate rules.
Create a new tag
In the firewall web interface, navigate to Objects > Tags. Click 'Add'. Give the tag a descriptive name like 'Finance_Dept' and optionally assign a colour. This creates the label you will later apply to objects. Without this step, you cannot use tags anywhere.
Apply the tag to an object
Navigate to the object you want to tag (for example, an address object in Objects > Addresses). Click the object name to edit it, or click 'Add' to create a new one. In the 'Tags' field, select the tag you created. The tag now appears next to that object in the list. This step links the organisational label to a specific IP or group.
Configure an External Dynamic List
Go to Objects > External Dynamic Lists. Click 'Add'. Give the list a name (like 'Unit42_Threat_Feed'), select the type (IP, URL, or Domain), and enter the Source URL where the list is hosted. Set the update interval (default 5 minutes). This tells the firewall where to fetch the list and how often to check for updates.
Create a custom URL category
Navigate to Objects > Custom Objects > URL Category. Click 'Add'. Give the category a name like 'Blocked_Job_Sites'. In the 'URL List' section, add the specific URLs (like linkedin.com) or patterns (like *.example.com). This creates a container of URLs that you can reference in security rules.
Write a security rule that uses the tag, EDL, or custom category
Go to Policies > Security and click 'Add' to create a new rule. In the rule's 'Source' or 'Destination' tab, you can reference an address group that has a specific tag, or reference the EDL directly. In the 'Service/URL Category' tab, you can select your custom URL category as a match condition. This is where the organisational tools finally affect traffic – the rule will only apply to traffic that matches the tagged objects or listed items.
Let me walk you through a day in the life of Maria, a network administrator at a mid-sized insurance company called SecureShield Insurance. SecureShield has 500 employees working from two offices and 100 remote workers. Maria manages a Palo Alto Networks firewall that sits at the internet edge, controlling all traffic in and out of the company.
8:00 AM – Morning check Maria opens the firewall web interface. She sees 15 security rules, each with a colour-coded tag. The green-tagged rules are for 'Allow Web Traffic', the red-tagged rules are for 'Block Malware', and the yellow-tagged rules are for 'Guest WiFi'. Without these tags, she would have to read each rule's description to remember what it does. With tags, she can filter the rule list to show only 'Block Malware' rules and immediately see all four of them.
9:30 AM – Threat intelligence update The company subscribes to a threat intelligence service that provides a constantly updated list of known phishing domains. Maria configured an EDL in the firewall to fetch this list every 10 minutes from a URL provided by the service. She doesn't have to think about updating the list – the firewall does it automatically. If a new phishing domain appears at 9:35 AM, by 9:40 AM the firewall will have the new list and will block traffic to that domain.
11:00 AM – HR department request The HR director emails Maria: 'Please block access to all job search websites like LinkedIn, Indeed, and Monster during work hours. Our employees are distracted.' Maria can't simply block the 'Social Networking' category because that would also block Facebook and Twitter, which the marketing department uses for work. Instead, she:
Creates a custom URL category called 'HR_Restricted_Job_Sites'
Adds linkedin.com, indeed.com, and monster.com to it
Creates a new security rule that blocks traffic to that custom URL category
Applies the rule to the IP range of employee workstations, not to the HR department's own workstations
Tags the new rule with a yellow tag labelled 'HR_Restrictions'
The whole job takes 15 minutes. Without custom URL categories, she would have to either block the whole 'Social Networking' category (which breaks marketing's workflow) or create three separate rules (which clutters the rule base).
2:00 PM – Incident response The security team identifies a new malware variant that communicates with command-and-control servers at four specific IP addresses. Maria immediately updates the EDL she uses for known malware IPs by adding those four IPs to the hosted list file. Within five minutes, the firewall downloads the updated list and starts blocking traffic to those IPs. She doesn't need to create new rules or restart anything.
4:30 PM – Audit preparation The IT manager asks for a report of all rules that apply to the finance department. Maria filters the firewall rules by the 'Finance_Dept' tag and exports the ruleset. She couldn't do this without tags – she would have to manually read each rule to check if it mentions finance IP addresses.
Key actions an IT professional performs regularly:
Creating tags to organise rules by department, function, or priority
Configuring EDLs with URLs from threat intelligence feeds, custom blocklists, or partner organisations
Updating the hosted list files that EDLs point to (often a simple text file on a web server)
Creating custom URL categories for organisation-specific web filtering needs
Assigning tags to objects and rules during initial setup or maintenance
Monitoring EDL update status to ensure lists are refreshing correctly
Testing custom URL categories to confirm they match the intended websites
The PCNSA exam tests your understanding of tags, external dynamic lists, and custom URL categories in very specific ways. Here are the key areas you need to master.
Tags – what the exam tests:
The exam expects you to know that tags are purely organisational. They do NOT affect firewall behaviour on their own. A common trap question asks 'What happens to traffic when you assign a tag called Block_All to an IP address?' The correct answer is 'Nothing, until a security rule uses that tag in a match condition.' Tags only matter when a security rule references them.
You need to know that tags can be applied to multiple object types: IP addresses, address groups, security rules, and user groups. The exam might ask which objects can receive tags – the answer is all of the above.
Tags have optional colours. The colour is for visual organisation only and has no security function.
The exam tests that tags are created in the Objects > Tags section of the web interface, not in the Policies section.
External Dynamic Lists – what the exam tests:
EDLs are always updated automatically on a schedule. The firewall fetches the list from an external URL. You cannot manually push updates to an EDL – you must update the file at the source URL.
The exam loves to test the update interval. EDLs can be configured to update as frequently as every 5 minutes. The default is 5 minutes. If a question says 'every 1 minute' or 'every hour', those are wrong unless explicitly configured.
EDLs can contain IP addresses, URLs, and domain names – but not user names, port numbers, or application IDs. The exam might present a trap where an EDL contains user names and ask why it doesn't work.
The list format matters: each entry must be on its own line, with no headers or comments in the standard format. The exam might show a malformed list and ask what the problem is.
EDLs require the firewall to have internet access to the URL hosting the list. A common exam scenario: the firewall cannot reach the EDL URL – the correct answer is that the ELD will fail to update, and the last known good list will continue to be used.
You must know the difference between an EDL and a static list. A static list never changes unless an administrator manually edits it. An EDL changes automatically based on the remote source.
Custom URL Categories – what the exam tests:
Custom URL categories are created in Objects > Custom Objects > URL Category. The exam may ask about this exact navigation path.
Custom URL categories can contain specific URLs (like www.example.com) or URL patterns with wildcards (like *.example.com). The exam tests whether you know that wildcards are allowed.
A key trap: custom URL categories override the default Palo Alto Networks URL categories. If you create a custom category 'Malware' and add legitimate URLs to it, the firewall will treat those URLs as malware – it does not merge your list with Palo Alto's built-in list. The custom category is entirely separate.
The exam tests that custom URL categories can be used in security rules just like built-in categories. There is no special rule type for custom categories.
Exam questions often ask about the priority of custom URL categories versus built-in categories. The correct answer: custom and built-in categories are at the same level. If a URL matches both a custom category and a built-in category, the most specific rule that references either category will apply.
Common trap patterns to watch for:
Questions that suggest tags can block traffic directly (they cannot – rules block traffic, tags just label things)
Questions that confuse EDLs with static lists
Questions that claim custom URL categories are only for blocking (they can be used for allow rules too)
Questions that mix up the maximum update frequency of EDLs (5 minutes, not 1 minute)
Questions that suggest tags can be assigned automatically by the firewall (they cannot – an administrator must assign them)
Key definitions to memorise:
Tag: a label attached to an object for organisational purposes
External Dynamic List (EDL): a list of IPs, URLs, or domains fetched automatically from an external URL
Custom URL Category: a user-defined group of URLs used for web filtering in security rules
Match condition: the criteria in a security rule that determines which traffic the rule applies to
Source URL: the web address where the EDL content is hosted
Tags are purely for organisation and have zero effect on firewall behaviour until a security rule uses that tag as a match condition.
External Dynamic Lists automatically update from a remote URL on a schedule, keeping threat intelligence current without human intervention.
Custom URL Categories let you define organisation-specific website lists that work exactly like built-in Palo Alto categories in security rules.
EDLs can contain IP addresses, URLs, and domain names only – never user names, ports, or applications.
If an EDL cannot be refreshed, the firewall uses the last successfully downloaded list, not a default allow-all.
Custom URL categories do not merge with built-in categories – they are entirely separate lists you create and maintain.
Tags can be applied to multiple object types including address objects, address groups, security rules, and user groups.
Organising your rule base with tags, EDLs, and custom categories reduces the number of individual rules you need from hundreds to dozens.
These come up on the exam all the time. Here's how to tell them apart.
Tags
Labels attached to objects or rules
Do not affect traffic directly
Applied manually by an administrator
EDLs
Lists of IPs/URLs/domains fetched automatically
Directly affect traffic via security rules
Updated automatically from an external source
Custom URL Categories
Created manually by the administrator
Contain only URLs the administrator adds
Do not update automatically
Built-in URL Categories
Provided by Palo Alto Networks by default
Contain thousands of URLs curated by Palo Alto
Updated automatically via threat intelligence updates
EDLs
Update automatically on a schedule
Cannot be edited manually in the firewall
Point to an external URL for the data source
Static Address Groups
Never change unless edited manually
Can be edited directly in the firewall GUI
Contain IP addresses typed in by an administrator
Tag on an Object
Does not affect traffic on its own
Is for organisational purposes only
Cannot be directly referenced in rule configuration as a match field
Match Condition in a Rule
Directly determines which traffic the rule applies to
Controls security policy enforcement
Is the primary condition that triggers action (allow/block)
Mistake
Tags can automatically block or allow traffic if I assign them to an IP address.
Correct
Tags are purely labels for organisation. They have no effect on traffic until a security rule explicitly uses that tag as a matching criterion.
People often assume that labelling something 'Bad' means the firewall will automatically block it, because that is how human intuition works. Firewalls require explicit, separate rules.
Mistake
If my firewall cannot reach the EDL URL, traffic will be allowed until the list updates.
Correct
When an EDL cannot be refreshed, the firewall continues using the last successfully downloaded version of the list. Traffic continues to be blocked or allowed based on the last known good list.
People assume the firewall 'gives up' when it cannot fetch the list, but firewalls are designed to fail closed (block) or fail with the last known data, not to allow everything.
Mistake
Custom URL categories merge with built-in Palo Alto categories automatically.
Correct
Custom URL categories are entirely separate lists. They do not merge with built-in categories. If you create a custom category named 'Malware', it contains only the URLs you added, not Palo Alto's malware list.
The name 'category' suggests a folder that groups things together, so people think Palo Alto's list and your list get combined. In reality, they remain distinct.
Mistake
EDLs can contain IP addresses, URLs, domain names, and user names.
Correct
EDLs can contain IP addresses, URLs, and domain names only. They cannot contain user names, port numbers, or application IDs. Separate list types exist for those.
Users think 'a list is a list' and assume any data type works. Palo Alto designed EDLs specifically for IP/URL/domain threat intelligence feeds, not for user management.
Mistake
If I put a tag on a security rule, the tag itself becomes a condition for that rule.
Correct
Tags applied to a security rule are for identification and filtering only. They do not change the rule's matching logic. The rule still matches based on its source, destination, application, and other fields.
People see that tags can be applied to rules and assume they affect how the rule works, confusing 'labelling' with 'configuring'.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Yes, you can multi-select objects in the address or rule list and assign a tag to all of them simultaneously using the 'Tag' button at the top of the list. You do not need to edit each object individually.
The firewall will continue using the last successfully downloaded version of the list. It will attempt to refresh on the configured schedule, and if the source comes back online, it will automatically resume fetching updates.
Absolutely. Custom URL categories can be used in any security rule, including 'allow' rules. For example, you could create a custom category of approved cloud services and write an allow rule for that category.
Tags are local to each firewall unless you use Panorama (a centralised management tool). On standalone firewalls, tags you create on one firewall do not appear on another unless you manually replicate them.
In the Objects or Policies sections, use the filter bar and type 'tag equals [tagname]'. The firewall will display only objects or rules that carry that tag.
No. EDLs and custom URL categories are separate object types. You cannot nest an EDL inside a custom URL category, but you can reference both in the same security rule by adding multiple match conditions.
You've finished Managing Objects: Tags, External Dynamic Lists, and Custom URL Categories. Continue through the PCNSA study guide to build a complete picture of the exam.
Done with this chapter?