topic Address object limits / Panorama ... in General Topics

Address object limits / Panorama ...

DJFirewallSupport — Wed, 03 Oct 2012 19:50:11 GMT

Heya,

Two related questions regarding address objects and current limits....

1) Is there a command to see the number of address objects currently on a specific firewall (whether they're local objects or Panorama objects)? I'm familiar with how to view address object limits for a particular platform (show system state | match address)...but would like to see how many address objects are currently on a given firewall.

2) Will there be any future enhancement to Panorama such that address objects not in use in a policy do not get downloaded to all firewalls in a given device group? As this would certainly lessen the number of address objects on any Panorama-managed firewall. And if there will be such a feature, will there also be a provision to go back and remove address objects not used in policies but that live on device today?

Thanks and regards,

- Dave

Re: Address object limits / Panorama ...

sdurga — Wed, 03 Oct 2012 21:02:12 GMT

Regarding the first question -As far as I know there is no such command that says how many of the objects are present on the firewall and out of them how many belong to panorama. The work around would be to check this from the XML configuration file. I have opened my config file in the xml tool and navigated to address objects section and I can see how many of them are configured on the firewall as below.

As u can see i have 31 of them. I know this is a hardway, thought this might help. Again this will not give any info pushed from the panorama as the panorama objects will not show up in the firewall config file. Do not know if is a better way.

Re: Address object limits / Panorama ...

sdurga — Wed, 03 Oct 2012 21:16:18 GMT

Oops you can find the number of objects on the device from the web-ui itself, I missed that part.

Re: Address object limits / Panorama ...

DJFirewallSupport — Thu, 04 Oct 2012 21:11:33 GMT

Thanks for the reply sdurga...

Yes, as you say Panorama objects do not show up in XML config file on firewall...I wonder if there is a hidden command from CLI to see them? I wouldn't be surprised...

Yep, I know you can see them on Web-UI of device and just count them...but was looking for another method for box to give me total #... thanks.

- Dave

Re: Address object limits / Panorama ...

Bart_Jocque — Wed, 10 Oct 2012 14:38:40 GMT

What is this "XML tool" ?

never heard of it.

Can you share some details about this tool ?

Re: Address object limits / Panorama ...

sdurga — Wed, 10 Oct 2012 16:00:22 GMT

Any XML editor to display the Config XML file in the organised way. I use XML marker which is a free tool . available at the following link XML Marker Free XML Editor and Json Editor - XML Marker