Are there performance issues due to object groups?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

Are there performance issues due to object groups?

L3 Networker

Hello all,

As shown in the attached photo below, the limit on the number of members in the address group of PA-3220 is 2500.

1. We are going to apply about 2000 Object Members per address Group to the PA-3220, is there any performance issue? If there were, what performance issues would there be?

2. If 4,000 objects are grouped, is there no problem if you divide 2,000 objects into 2 groups and apply them to one policy?

Screen Shot 2022-11-23 at 9.20.43 AM.png

Thanks and Regards,

5 REPLIES 5

L4 Transporter

Hello @JoHyeonJae 

 

The limits of each model of firewall palo alto networks, already consider the use or possible use of that group in one or more policies, therefore at performance level there should not be any problem, since it is within the threshold limit for that model.

 

Regards

High Sticker

@Metgatz 

Thank you for your update.

Can I understand that there is no performance issue for question number one?
And is there no problem with question number 2?

Hello @JoHyeonJae 

 

Exactly, there are no issues, since it is part of the limits declared for each model.

 

Exactly, in point 2, as long as you do not exceed the total limit of address objects 30.000 30k and do not exceed 2500 2.5k address objects per group, it is correct.

 

Regards

High Sticker

@Metgatz 
Thank you for your prompt response!

Is there any documentation related to this subject? (I guess there is no documentation so)

Thanks,

Hey @JoHyeonJae 

There is no documentation as such, since what you indicate is totally valid based on the firewall model and its officially declared limits.

I have done similar things with other models of firewalls bordering the limits and I have not had any problem.

 

Here is a similar thread:

https://live.paloaltonetworks.com/t5/general-topics/address-group-limitation/td-p/44196

 

Greetings

High Sticker
  • 1557 Views
  • 5 replies
  • 0 Likes
  • 101 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!