arp/mac cache limits - any plans to increase them?

[networkadmin]

Palo Alto seem to have the lowest arp/mac cache limits of any firewall I've ever come across.

Are there any plans to increase the limits please?

[BobW]

Out of curiosity, what are the limits and how do you know if you approach them, etc.

Thanks

Bob

[zarina]

You can get the max number of arp entries supported on a platform using the following command:

show system state filter cfg.general.max*

Here is a sample output for 200:

admin@lab108-PA-200(active)> show system state filter cfg.general.max*
cfg.general.max-address: 0x9c4

cfg.general.max-address-group: 0xfa

cfg.general.max-address-per-group: 0x1f4

cfg.general.max-appinfo2ip-entry: 500

cfg.general.max-arp: 0x1f4

cfg.general.max-blacklist: 0x61a8

You can also get this value from:

admin@lab108-PA-200(active)> show arp all
maximum of entries supported :      500

default timeout:                    1800 seconds

total ARP entries in table :        25

total ARP entries shown :           25

status: s - static, c - complete, e - expiring, i - incomplete

[essnet]

Hello,

You can also look at specsheets PDFs on PaloAlo home website, like this one: http://media.paloaltonetworks.com/documents/PA500_Specsheet.pdf

This is a very good limitation to know:  MAC table size/device: 500  for PA-500