topic Re: Max number of units (aeX.Y subinterfaces) supported under a single AE interface? in Next-Generation Firewall Discussions

Max number of units (aeX.Y subinterfaces) supported under a single AE interface?

VivekMs — Wed, 24 Dec 2025 19:08:09 GMT

Hi Team,

I’m looking to confirm the maximum number of units (aeX.Y subinterfaces) that can be configured under a single Aggregate Ethernet (AE) interface on Palo Alto firewalls.

Specifically for models like PA-440,PA-450, PA-820, and PA-850, and across recent PAN-OS versions:

• What is the hard platform limit for aeX.Y units per AE?
• Are there any model-specific or PAN-OS–specific differences?
• Any recommended practical limits or best practices from field experience?

I wasn’t able to find a definitive number exposed via CLI (for example, show system state).

Appreciate confirmation or anyone who has validated this in production.

Thanks!

Re: Max number of units (aeX.Y subinterfaces) supported under a single AE interface?

emr_1 — Thu, 25 Dec 2025 06:51:15 GMT

8 interfaces per AE
https://docs.paloaltonetworks.com/ngfw/networking/configure-interfaces/configure-an-aggregate-interface-group#:~:text=Each%20aggregate%20group%20can%20have%20up%20to%20eight%20interfaces

Max num. of AE is here

https://www.paloaltonetworks.com/products/product-comparison?chosen=pa-440,pa-450,pa-820,pa-850

Re: Max number of units (aeX.Y subinterfaces) supported under a single AE interface?

L.LampkinIII — Tue, 03 Feb 2026 13:38:53 GMT

Per this earlier post (2021), no one was aware of a maximum number of SUB-interfaces.

Aggregated Ethernet interfaces - recommended maximum number of sub-interfaces

When I check the docs, it mentions numbering sub-interfaces from 1 to 9,999. so, maybe 9,999 would be the theoretical limit, but keep in mind that the 2021 post mentioned that other surrounding features may limit how many you effectively use, so it may be more a function of what features you choose to enable.

Virtual Wire Subinterface

PA-7000 Series Layer 2 Subinterface

Layer 3 Subinterface

Log Card Subinterface