topic USER ID MAX USERS IN A GROUP??? in General Topics

USER ID MAX USERS IN A GROUP???

alle — Thu, 09 Aug 2012 10:37:44 GMT

Hello,

I've configured on PA5060 an Idenfication with AD:

PA5060: 4.1.6 USER ID AGENT : 4.1.4-3

LDAP SERVER 389

I do a group mapping by group but this group have more than 16000 users.

when I do a show user usersIDS , I can't see all my users. I know that AD have a limitation of page size to 1000 users by request.

do you know if they are an limitation for the numbers of users in a group when you use PA ???

do you have a workaround for this problem???

thanks,

Re: USER ID MAX USERS IN A GROUP???

mikand — Mon, 20 Aug 2012 22:11:57 GMT

I would also be interrested in if someone has some more information regarding this matter.

Re: USER ID MAX USERS IN A GROUP???

snisar — Thu, 13 Sep 2012 06:28:33 GMT

The limit is in the number of groups and user-mappings each firewall can hold. For now it is 64K users and 640 groups. Per my understanding, there is no hard limit of maximum number of users each group can hold. You can have all 64k users in one group or can evenly or unevenly distribute them in each group. Please let me know if this is helpful.

Re: USER ID MAX USERS IN A GROUP???

mikand — Thu, 13 Sep 2012 09:00:28 GMT

Is this a hard limit due to restrictions in pfga/asics being used or is this a software limit (which PA, after a feature request, could make larger for lets say PA-5xxx series)?

Re: USER ID MAX USERS IN A GROUP???

Ludwig — Tue, 13 Aug 2013 12:50:52 GMT

To be a little bit more specific concerning the 640 groups "a firewall can hold": --> This is only the number of groups that can be used in the policies of the firewall (source or destination user section), but the firewall can store more than 640 groups in its database, which of course is a MUST because many customers might have more than 640 groups in their ADs.

To see the actual number of different groups, you can use the following command on the CLI:

show user group list | match Total

This shows the number of groups.

Re: USER ID MAX USERS IN A GROUP???

CMG — Wed, 14 Aug 2013 08:44:57 GMT

Not sure if it's relevant to the query your doing.. but be wary when doing ldap queries of the Microsoft AD group "domain users".. it's generally not a standard/normal group. It's usually whats known as the "primary" group and as such doesn't show up when doing a "memberof" query. Some ldap query systems have built in workarounds to deal with this.. I'm unsure if PAN has caught up with this since last time I was testing "domain users" queries back in the early PANOS 4.x days.

User accounts can sometimes have had their "primary group" changed which can cause some confusions..

A sorta explanation from Microsoft

Setting Primary Group Excludes the User from the Group Membership in Active Directory

There's other better explanations around on the internet if you look around for "active director primary group"..

Re: USER ID MAX USERS IN A GROUP???

padden — Mon, 15 Mar 2021 15:21:59 GMT

I am having a difficult time finding the 160 limit in the Palo Alto docs.

Can you send me a link to that please?

Re: USER ID MAX USERS IN A GROUP???

padden — Mon, 15 Mar 2021 15:28:00 GMT

Where is this limit documented?

Re: USER ID MAX USERS IN A GROUP???

myongpark — Wed, 20 Oct 2021 19:33:21 GMT

Does anyone know if a nested group counts against the limit of 640, so if one group contains 10, does that count as 1, or as 11?

Re: USER ID MAX USERS IN A GROUP???

RajendraSolanki — Thu, 18 Apr 2024 08:54:06 GMT

how many users we can create in the PA-440 Model for the splash page (Captive Portal-based login)?

Re: USER ID MAX USERS IN A GROUP???

Brandon_Wertz — Thu, 18 Apr 2024 18:31:37 GMT

@RajendraSolanki wrote:

how many users we can create in the PA-440 Model for the splash page (Captive Portal-based login)?

Are you wanting to use local authentication for the captive portal authentication process? If you are asking for the local database it sounds like there might not be a hard limit per se: https://live.paloaltonetworks.com/t5/general-topics/number-of-users-on-local-database/td-p/37268 (This topic is really old, but still probably accurate.)