topic Re: PA specifiations and limitations in General Topics

PA specifiations and limitations

bdaussin — Mon, 11 Jul 2011 08:08:42 GMT

Hello,

We are using Panorama to manage all our PA devices. Depending on our needs, we use plateforms from PA500 to PA5050. Last week we tried to commit a change to a PA500 and we get the message : address group limit exceeded !!!! At the moment we have 253 address groups. So the limit seems to be 250 address groups for a PA500.

Could you give us this kind of limitations for each of you device. I didn't find anything about this.

Thanks,

Re: PA specifiations and limitations

markjx — Mon, 11 Jul 2011 23:18:27 GMT

Good luck, man. I've asked for stuff like this for years and just get shot down. Their school of thought is just to let the customer experience an outage and then try to figure out why.

Re: PA specifiations and limitations

rnitz — Mon, 11 Jul 2011 23:40:48 GMT

The address group limit for the PA-500 is 250.

Re: PA specifiations and limitations

bdaussin — Tue, 12 Jul 2011 06:45:17 GMT

By using the command "show system state", we are able to have a look at all limitations !!

What i do not anderstand is : Why Panaroma send all objects to Firewall even if these Objects are not used within the policies !! It's really not optimal.

Is there any plan to change this and send only the usefull objects ? It's really not efficient for large companies having to deal with both large and small sites and who want to use Panorama.

Thanks a lot.

Re: PA specifiations and limitations

markjx — Tue, 12 Jul 2011 11:50:50 GMT

I believe that 4.0 has some functionality around scoping objects to only go to the firewalls which actually use them.

Re: PA specifiations and limitations

bdaussin — Wed, 13 Jul 2011 03:35:34 GMT

Thanks for this answer.

I took a look at Panorama (v4) but I did'nt find this feature :smileyconfused:

Can someone give more details about this feature ?

Re: PA specifiations and limitations

jcostello — Wed, 13 Jul 2011 15:34:29 GMT

Clarification question. Do you have the firewalls in separate Device Groups on Panorama?

Thanks

James

Re: PA specifiations and limitations

bdaussin — Mon, 18 Jul 2011 07:46:23 GMT

Yes we do have device groups. In fact, for all plateforms (except PA500) we use vsys and device-groups.

Thanks in advance.