Are there performance issues due to object groups?

[JoHyeonJae]

Hello all,

As shown in the attached photo below, the limit on the number of members in the address group of PA-3220 is 2500.

1. We are going to apply about 2000 Object Members per address Group to the PA-3220, is there any performance issue? If there were, what performance issues would there be?

2. If 4,000 objects are grouped, is there no problem if you divide 2,000 objects into 2 groups and apply them to one policy?
 

Thanks and Regards,

[Metgatz]

Hello @JoHyeonJae 

The limits of each model of firewall palo alto networks, already consider the use or possible use of that group in one or more policies, therefore at performance level there should not be any problem, since it is within the threshold limit for that model.

Regards

[JoHyeonJae]

@Metgatz 

Thank you for your update.

Can I understand that there is no performance issue for question number one?
And is there no problem with question number 2?

[Metgatz]

Hello @JoHyeonJae 

Exactly, there are no issues, since it is part of the limits declared for each model.

Exactly, in point 2, as long as you do not exceed the total limit of address objects 30.000 30k and do not exceed 2500 2.5k address objects per group, it is correct.

Regards

[JoHyeonJae]

@Metgatz 
Thank you for your prompt response!

Is there any documentation related to this subject? (I guess there is no documentation so)

Thanks,

[Metgatz]

Hey @JoHyeonJae 

There is no documentation as such, since what you indicate is totally valid based on the firewall model and its officially declared limits.

I have done similar things with other models of firewalls bordering the limits and I have not had any problem.

Here is a similar thread:

https://live.paloaltonetworks.com/t5/general-topics/address-group-limitation/td-p/44196

Greetings