topic Re: Is there a limit to the number of objects within a dynamic address group? in General Topics

Is there a limit to the number of objects within a dynamic address group?

PaulAmmann — Wed, 31 Mar 2021 17:32:18 GMT

I'm working on doing some clean up, and I want to take advantage of dynamic address groups. I have 943 address objects tagged and one dynamic group.

When I monitor the logs, I see some traffic bypassing my rule and going to rules below. I checked the address objects and they are tagged.

As a test I put all 943 address objects into a static group. I created a new tag, tagged the static group, and then create a new dynamic group. I put a new test rule in, and all the traffic now hitting this rule.

I'm not crazy about the solution, because it feels like I just created a group within a group but it's working so far. That's why I wonder if there is a limit with how many objects can be inside a dynamic group.

I'm working with a PA-5260.

Re: Is there a limit to the number of objects within a dynamic address group?

kiwi — Thu, 01 Apr 2021 10:41:09 GMT

Hi @PaulAmmann ,

As far as I can see 943 objects in an address group shouldn't be a problem for the PA-52xx. As per the products comparison's page, the PA-5260 can handle 2500 members per address group:

https://www.paloaltonetworks.com/products/product-selection

You can also check this on your device with the following command:

admin@PA-VM> show system state | match cfg.general.max-address cfg.general.max-address: 10000 cfg.general.max-address-group: 0x3e8 cfg.general.max-address-per-group: 0x9c4

where you might want to convert hex to dec:

0x3e8 = 1000

0x9c4 = 2500

Cheers,

-Kiwi.

Re: Is there a limit to the number of objects within a dynamic address group?

LuckyRangra — Fri, 21 Jan 2022 11:14:51 GMT

I have the same problem. I have a PA-5250 who is using a single DAG group with more than 70,000 address objects as its members. The limit for member-per-address-group is 2,500 for PA-5250.

It was working fine but then we made a change on rule-base (some another policy) and then it stopped working.

Re: Is there a limit to the number of objects within a dynamic address group?

RobertShawver — Thu, 13 Mar 2025 15:08:40 GMT

Is there a way to find out how many count against the max?

show system state | match cfg.general.max-address

That will tell you that the max is 10000, but how can I find the number counting against that 10000?

Re: Is there a limit to the number of objects within a dynamic address group?

Brandon_Wertz — Thu, 13 Mar 2025 20:35:48 GMT

@RobertShawver wrote:

Is there a way to find out how many count against the max?
show system state | match cfg.general.max-address
That will tell you that the max is 10000, but how can I find the number counting against that 10000?

Can't you just look at the UI of that object group? It will tell you what the count is. Or platform object count are you looking to see your limits on?