topic Re: Are there performance issues due to object groups? in General Topics

Are there performance issues due to object groups?

JoHyeonJae — Wed, 23 Nov 2022 00:21:36 GMT

Hello all,

As shown in the attached photo below, the limit on the number of members in the address group of PA-3220 is 2500.

1. We are going to apply about 2000 Object Members per address Group to the PA-3220, is there any performance issue? If there were, what performance issues would there be?

2. If 4,000 objects are grouped, is there no problem if you divide 2,000 objects into 2 groups and apply them to one policy?

Thanks and Regards,

Re: Are there performance issues due to object groups?

Metgatz — Wed, 23 Nov 2022 06:03:52 GMT

Hello @JoHyeonJae

The limits of each model of firewall palo alto networks, already consider the use or possible use of that group in one or more policies, therefore at performance level there should not be any problem, since it is within the threshold limit for that model.

Regards

Re: Are there performance issues due to object groups?

JoHyeonJae — Wed, 23 Nov 2022 06:07:15 GMT

@Metgatz

Thank you for your update.

Can I understand that there is no performance issue for question number one?
And is there no problem with question number 2?

Re: Are there performance issues due to object groups?

Metgatz — Wed, 23 Nov 2022 06:10:43 GMT

Hello @JoHyeonJae

Exactly, there are no issues, since it is part of the limits declared for each model.

Exactly, in point 2, as long as you do not exceed the total limit of address objects 30.000 30k and do not exceed 2500 2.5k address objects per group, it is correct.

Regards

Re: Are there performance issues due to object groups?

JoHyeonJae — Wed, 23 Nov 2022 06:14:35 GMT

@Metgatz
Thank you for your prompt response!

Is there any documentation related to this subject? (I guess there is no documentation so)

Thanks,

Re: Are there performance issues due to object groups?

Metgatz — Wed, 23 Nov 2022 06:20:41 GMT

Hey @JoHyeonJae

There is no documentation as such, since what you indicate is totally valid based on the firewall model and its officially declared limits.

I have done similar things with other models of firewalls bordering the limits and I have not had any problem.

Here is a similar thread:

https://live.paloaltonetworks.com/t5/general-topics/address-group-limitation/td-p/44196

Greetings