Limitations for auto-zone assign?

[FilipElsen]

Hi,

@sjanita @aestevez  @dgildelaig 

We had a huge amount of Checkpoint clusters to be migrated (26) to Palo Alto. They’re reaching the end : 23 cluster migrated – 3 to be done.

With one of the 3 remaining, our 'management' cluster, we hit an issue/limitation ?

This is the cluster with the most heavy policy, routing etc : 15K objects, 3289 security rules, 315 subinterfaces and 1828 routes…..

• When performing the auto-zone assign on the security rules, it doesn’t work at all.
• When performing the auto-zone assign on the nat rules (115), it’s working fine.
• Even when using the auto-zone assign with 1 rule at the time, it doesn’t work.

Is there a limitation : parameter/memory/…. And can it be modified?

I'm using Expedition on dedicated HW (also used for ML & Rule enrichment) and have therefore extra capacity (24cores, 256GB RAM, 6TB disk)

315 subinterfaces, 1828 routes

Thanks a lot,

Filip

[FilipElsen]

[FilipElsen · Accepted solution]

Found the solution/root cause.

The auto-zone assign did not work, since amongst the 1828 routes, no default route (we don't need it) was present.

When adding a (dummy) default route, the auto-zone assign works.

Best regads,

Filip Elsen