Limitations for auto-zone assign?

FilipElsen — Wed, 27 May 2020 08:11:51 GMT

Hi,

We had a huge amount of Checkpoint clusters to be migrated (26) to Palo Alto. They’re reaching the end : 23 cluster migrated – 3 to be done.

With one of the 3 remaining, our 'management' cluster, we hit an issue/limitation ?

This is the cluster with the most heavy policy, routing etc : 15K objects, 3289 security rules, 315 subinterfaces and 1828 routes…..

When performing the auto-zone assign on the security rules, it doesn’t work at all.
When performing the auto-zone assign on the nat rules (115), it’s working fine.
Even when using the auto-zone assign with 1 rule at the time, it doesn’t work.

Is there a limitation : parameter/memory/…. And can it be modified?

I'm using Expedition on dedicated HW (also used for ML & Rule enrichment) and have therefore extra capacity (24cores, 256GB RAM, 6TB disk)

315 subinterfaces, 1828 routes

Thanks a lot,

Filip

Re: Limitations for auto-zone assign?

FilipElsen — Wed, 27 May 2020 08:13:10 GMT

FilipElsen — Thu, 28 May 2020 06:46:40 GMT

Found the solution/root cause.

The auto-zone assign did not work, since amongst the 1828 routes, no default route (we don't need it) was present.

When adding a (dummy) default route, the auto-zone assign works.

Best regads,

Filip Elsen