About address and EBL limitation for maximum

[KiCheon.Lee]

Hello.

I want to know my question what address and EBL maximum from you.

1.

https://live.paloaltonetworks.com/t5/Configuration-Articles/Using-IP-Address-Lists-on-Palo-Alto-Netw...

The above documnet describes " Each imported list can contain up to 5,000 IP addresses (IPv4 and/or IPv6), IP ranges, or subnets." 

How many can FW creat lists? What are Miximum?

2. 

I checked the result of the following CLI output,

show system state filter cfg.general.max*

->cfg.general.max-blacklist : 25000

Is the above black list about URL Filtering? 

I found a below discussiton

https://live.paloaltonetworks.com/t5/General-Topics/Size-limit-for-URL-block-list/m-p/27631/highligh...

Right?

3. 

This question is important.

PA-3020 can have miximum 5000 address.

"cfg.general.max-address: 5000"

I want to know whether this vaule inculde EBL list or exclude it.

And

PA can make security rules without address objects.

When FW can create to write IP on security rules, How many can I make IPs without address object? 

What are maximum? Are this maximum  included "max-address : 5000"?

Thanks,

KC Lee

[rmonvon · Accepted solution]

Hi there...This is extracted from the 7.0 admin guide.  You can have 10 DBL lists.

2) Yes, the maximum number of entries (in your case 25,000) is for the entire device, and is shared across the allow list, block list, and custom URL categories.

3) The DBL is separate from the max address.

Thanks.

[KiCheon.Lee]

Hi,

Thanks for your anwer.

May I ask you question more further?

About No.3 question I asked.

I heard from someone what one DBL list place in one of  all address object.

You meaned one DBL list does not equal one address object. Right?

And a new question.

Please look at the following document.

https://live.paloaltonetworks.com/t5/Configuration-Articles/Using-IP-Address-Lists-on-Palo-Alto-Netw...

This doc describes " Each imported list can contain up to 5,000 IP addresses (IPv4 and/or IPv6), IP ranges, or subnets."

But It is different between the above sentence and a result I tested.

PA-200 can have 2200 lines of one DBL list [2500(max addresses) - 300(system register IPs)]

PA-3020 can have 4700 lines of one DBL list [5000(max addresses) - 300(system register IPs)]

What is the truth between all platform can have 5,000 or each models can have each other mas address without 300?

I hope let me know it.

Thanks.