topic Re: arp/mac cache limits - any plans to increase them? in General Topics

arp/mac cache limits - any plans to increase them?

networkadmin — Sun, 27 May 2012 14:40:01 GMT

Palo Alto seem to have the lowest arp/mac cache limits of any firewall I've ever come across.

Are there any plans to increase the limits please?

BobW — Mon, 28 May 2012 15:58:51 GMT

Out of curiosity, what are the limits and how do you know if you approach them, etc.

Thanks

Bob

zarina — Tue, 29 May 2012 22:49:49 GMT

You can get the max number of arp entries supported on a platform using the following command:

show system state filter cfg.general.max*

Here is a sample output for 200:

admin@lab108-PA-200(active)> show system state filter cfg.general.max*
cfg.general.max-address: 0x9c4

cfg.general.max-address-group: 0xfa

cfg.general.max-address-per-group: 0x1f4

cfg.general.max-appinfo2ip-entry: 500

cfg.general.max-arp: 0x1f4

cfg.general.max-blacklist: 0x61a8

You can also get this value from:

admin@lab108-PA-200(active)> show arp all
maximum of entries supported : 500

default timeout: 1800 seconds

total ARP entries in table : 25

total ARP entries shown : 25

status: s - static, c - complete, e - expiring, i - incomplete

essnet — Wed, 30 May 2012 08:58:41 GMT

Hello,

You can also look at specsheets PDFs on PaloAlo home website, like this one: http://media.paloaltonetworks.com/documents/PA500_Specsheet.pdf

This is a very good limitation to know: MAC table size/device: 500 for PA-500