Limitations for auto-zone assign?

Reply
Highlighted
L2 Linker

Limitations for auto-zone assign?

Hi,

@sjanita @aestevez  @dgildelaig 

We had a huge amount of Checkpoint clusters to be migrated (26) to Palo Alto. They’re reaching the end : 23 cluster migrated – 3 to be done.

With one of the 3 remaining, our 'management' cluster, we hit an issue/limitation ?

This is the cluster with the most heavy policy, routing etc : 15K objects, 3289 security rules, 315 subinterfaces and 1828 routes…..

  • When performing the auto-zone assign on the security rules, it doesn’t work at all.
  • When performing the auto-zone assign on the nat rules (115), it’s working fine.
  • Even when using the auto-zone assign with 1 rule at the time, it doesn’t work.

Is there a limitation : parameter/memory/…. And can it be modified?

I'm using Expedition on dedicated HW (also used for ML & Rule enrichment) and have therefore extra capacity (24cores, 256GB RAM, 6TB disk)

 

315 subinterfaces, 1828 routes

Thanks a lot,

Filip


Accepted Solutions
Highlighted
L2 Linker

Found the solution/root cause.

The auto-zone assign did not work, since amongst the 1828 routes, no default route (we don't need it) was present.

When adding a (dummy) default route, the auto-zone assign works.

 

Best regads,

Filip Elsen

 

View solution in original post


All Replies
Highlighted
L2 Linker

routes.jpgExpedition hw.jpgproject statistics.jpg

Highlighted
L2 Linker

Found the solution/root cause.

The auto-zone assign did not work, since amongst the 1828 routes, no default route (we don't need it) was present.

When adding a (dummy) default route, the auto-zone assign works.

 

Best regads,

Filip Elsen

 

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!