topic Re: Total number of profiles (xx) exceeds platform capacity (xx) in General Topics

Total number of profiles (xx) exceeds platform capacity (xx)

JohnJones — Thu, 13 Dec 2018 21:24:10 GMT

Some of our smaller PAs are starting to have their commits fail do to the number of profiles configured in Panorama. The error I receive is "Total number of profiles (xx) exceeds platform capacity (xx)". I followed this link but it does not seem to have helped: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm0DCAS

This had me disable the "Share Unused Address and Service Objects with Devices". Even though this has been disabled all of the unused security profiles are still applied to my firewalls where they are not needed. Is there something else that can be done to remove the unused security profiles?

-Thanks!

Re: Total number of profiles (xx) exceeds platform capacity (xx)

BPry — Thu, 13 Dec 2018 22:04:32 GMT

@JohnJones,

So profile is actually every policy in your entire rulebase; Security, NAT, QoS, PBF, Decryption, Tunnel Inspection, Application Override, Atuh, and DoS Protection. Remove any policies that you aren't actually using on the device and you'll be good to go.

View Max Profiles on device.

'show system state filter cfg.general.max* | match profile'

Re: Total number of profiles (xx) exceeds platform capacity (xx)

Remo — Thu, 13 Dec 2018 22:10:11 GMT

@BPry wrote:
@JohnJones,
So profile is actually every policy in your entire rulebase; Security, NAT, QoS, PBF, Decryption, Tunnel Inspection, Application Override, Atuh, and DoS Protection.

@BPry are you sure? Doesn't this mean security profiles like url, antivirus, anrispyware, vulnerability? Because these profiles are still shared with the firewalls even if you have the option "share unused ..." disabled (this option is only for address-, addressgroup-, service- and servicegroupobjects)

Re: Total number of profiles (xx) exceeds platform capacity (xx)

BPry — Thu, 13 Dec 2018 22:22:51 GMT

@Remo,

Nope, I was actually just modifying this. Really bad article on the knowledgebase that once I was looking at it more shouldn't exist. Profile accounts for the security profiles as you mention.