topic autocommit fail : Total NAT DIPP exceed in General Topics

autocommit fail : Total NAT DIPP exceed

Pattarachai — Thu, 22 Mar 2018 01:27:13 GMT

Hi all, I found the issue after upgrade Palo alto from PAN-OS 5.0-6.1.0 when to 6.1.0 auto-commit faile and show messages "Total NAT DIPP translated IP 804 exceeds the capacity of 800 " My model PA-5050 so, I would like to know this issue occur?

Re: autocommit fail : Total NAT DIPP exceed

reaper — Thu, 22 Mar 2018 10:50:29 GMT

Are you sure your system is a PA-5050? The PA-5050 has a DIPP capacity for 2000 rules, the PA-5020 has a capacity of 800

anyway, this means you configured too many DIPP rules and need to combine/prune policies to come within the system's capacity

Please also upgrade to 6.1.19 at your earliest convenience as this is the recommended release for PAN-OS 6.1

Re: autocommit fail : Total NAT DIPP exceed

Pattarachai — Thu, 22 Mar 2018 10:56:57 GMT

@reaperOhhh sorry Model Pa-5020 I would like to know whether this case autocommit fail 6.1.0 can upgrade to 6.1.19 from your recommend will not issue occur ?

Re: autocommit fail : Total NAT DIPP exceed

reaper — Thu, 22 Mar 2018 10:59:41 GMT

It will keep occuring until you adjust the configuration to fall below the maximum supported number of DIPP rules, unfortunately

This is a system limitation

upgrading to 6.1.19 just ensures you don't run into any other issues 🙂

Re: autocommit fail : Total NAT DIPP exceed

Pattarachai — Thu, 22 Mar 2018 11:05:58 GMT

@reaper Thank you for advice to me