topic Re: address-group limitation in General Topics

address-group limitation

Wirecard — Tue, 14 Feb 2012 13:45:52 GMT

Hi @all,

we’re using a PA-5020 active-passive Firewall-Cluster.

We recently noticed that the address-groups are limited to 500 items per group. As we have a list of nearly 1500 items (ip-address and network-addresses) to manage, I want to ask whether there are any performance issues known if we split the items in three or more groups.

Re: address-group limitation

mikand — Tue, 14 Feb 2012 14:00:59 GMT

Either performance or hardware limitations due to that the addressgroup is "compiled" into a list of actual addresses which is then loaded to the fpga/asics. However 500 as limit sounds to me more of a GUI limit than a true hardware limit (but thats just a feeling I got).

You could test this easily by creating another address-group and then try to use both of them in the same security rule (like both of them as sourceip or such). However be prepared to quickly rollback your config in case things go wrong...

Re: address-group limitation

Wirecard — Tue, 14 Feb 2012 14:44:21 GMT

OK thanks for your answer!

Well I'll try using three groups in a rule, and see whether I manage to blow the system

cya

chris