topic Re: Commit Error in General Topics

Commit Error

Ayesha — Mon, 02 Aug 2021 14:24:02 GMT

We're getting the following commit error on our PA-820 device:

Error: Number of addresses, dynamic groups, external-ip-lists, external-predefined-ip-lists and predefined ip-block-lists (2547) exceeds platform capacity (2500)

Re: Commit Error

laurence64 — Mon, 02 Aug 2021 16:57:41 GMT

The capacity for dynamic addresses on the pa-820 according to this article is 1000 https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/policy/monitor-changes-in-the-virtual-environment/use-dynamic-address-groups-in-policy

But that seems to be a little out of the 2500 that your commit error has which is the limit of the 850, hope that helps a little at least.

Re: Commit Error

BPry — Mon, 02 Aug 2021 18:19:19 GMT

@Ayesha,

Are you managing this directly or through Panorama? Panorama by default will attempt to sync all shared objects to a firewall even if they aren't being utilized in policy on that device. You can modify this by clearing the Share Unused Address and Service Objects with Devices option so that only shared objects that are actually referenced are being pushed.

If you are managing this locally directly on the firewall then I would do the following:

Ensure that you don't have any unused objects that people have simply failed to actually cleanup with time. If you attempt to delete an object that is in use you'll receive an error and it won't be removed.
Combine objects when and where you can to cut down on object count.

@laurence64,

The article that you mentioned is very specific to DAG IP addresses and not actual address objects, where the 820 can have 2,500.