topic Re: PA-4020 max NAT rule limit? in General Topics

PA-4020 max NAT rule limit?

debsPal0 — Sat, 15 Oct 2011 10:28:33 GMT

I am getting very close to the 1000 max NAT rule limit on my PA-4020's, are there any plans to increase this limit in future releases of PANOS or is my only option to upgrade to a PA-4050?

Re: PA-4020 max NAT rule limit?

gswcowboy — Sat, 15 Oct 2011 12:02:40 GMT

It appears the 4020 is still limited and the 4050 is a recourse @4K. Please defer to your Sales SE if it's in the roadmap.

Regards,

Renato

Re: PA-4020 max NAT rule limit?

debsPal0 — Mon, 17 Oct 2011 06:48:18 GMT

I'll contact my sales SE this morning. One final question - is there a command that I could run via CLI that would tell me the total number of NAT rules currently configured?

Regards,

James.

Re: PA-4020 max NAT rule limit?

gswcowboy — Mon, 17 Oct 2011 10:07:19 GMT

I apologize James but I wasn't able to determine if there's a CLI command to provide you a counter of sorts. I'll keep checking and confirm either way. I do know that the system will relay an error message when the limit is reached upon making a commit.

'Constraints failed for entry: Maximum number of rules reached."

Regards,

Renato

Re: PA-4020 max NAT rule limit?

gswcowboy — Mon, 17 Oct 2011 20:40:20 GMT

Hi James,

Unfortunately, there doesn't appear to be a CLI command that would provide a counter to indicate the number of NAT policies created. Recourse would be viewing the counter via GUI. If you'd like, you can submit a feature request for a CLI command to show this counter.

Regards,

Renato

Re: PA-4020 max NAT rule limit?

schiang1 — Mon, 17 Oct 2011 21:07:36 GMT

> show resource limit policies | match NAT

This will display the current NAT rules configured

Re: PA-4020 max NAT rule limit?

gswcowboy — Mon, 17 Oct 2011 22:03:47 GMT

Thanks for the help! Follow up question. On a 4050, I ran the command but it did not provide an output even though I have NAT policy configured. Also, as a follow up, how do you configure max rules?

admin@ROUTER-2(active)> show resource limit policies
policy current rules max rules------------------------- --------------- ---------------Security 1 not configured

admin@ROUTER-2(active)> show resource limit policies | match natadmin@ROUTER-2(active)>

-Renato

Re: PA-4020 max NAT rule limit?

rapoint_person — Tue, 18 Oct 2011 07:36:03 GMT

This shows the max configured at least:

show system state filter cfg.general.max* | match nat

then combine with show resource limit policies (as this command does not show the max, at least not the box I'm on)

Re: PA-4020 max NAT rule limit?

schiang1 — Tue, 18 Oct 2011 21:40:35 GMT

Renato,

Do you have virtual systems configured?

re:max rules, I noticed that too. I believe this is also related and configured per vsys.

Thanks