Confused over EBL size limit

[networkadmin]

We have a 3020 running 7.0.8 and are experimenting with MineMeld.

As soon as we get close to 5k IPs on the combined EBLs we get an error on a EBL refresh that it's been truncated as it's over the limit.

Palo Alto's own KB suggests that on an entry level PA-200 there is a limit of 50k items on all EBLs combined.

https://live.paloaltonetworks.com/t5/Learning-Articles/Working-with-External-Block-List-EBL-Formats-...

Support are telling me that the limit on 3020 is 5k which doesn't seem to make sense as a) why would a 200 support more than a 3020 and b) what's the point of something like minmeld if you can only have 5000 IPs?

Any clarification would be great.

[Greg_R]

For 7.0.x and earlier read this article. Specifically the 3rd entry down.

https://live.paloaltonetworks.com/t5/General-Topics/Dynamic-Block-List-Limit-on-number-of-entries/m-...

For 7.1 see this link.

https://live.paloaltonetworks.com/t5/General-Topics/Dynamic-Block-List-Limit-on-number-of-entries/m-...

Either way PanOS sets aside 300 entries so the number will always be 300 lower than the maximum. The limit on your 3020 running 7.0.8 will be 4700.

[lmori]

In addition to Greg answer about enanchements in 7.1, note that:

- you can limit the number of entries of MineMeld output feeds retrieved by PAN-OS using the 'n' URL parameter. Example: https://<minemeld>/feeds/inboundhcfeed?n=1000 will retrieve only the top 1000 entries of the feed 

- output feeds by default in MineMeld are sorted by recency. This means that when you retrieve the 1000 topmost entries, the 1000 most recent entries are retrieved

Regards,

luigi

[Sistemas_SanLucar]

Hi,

I have a Pa-500 version 6.1.0

show system state | match cfg.general.max-address

cfg.general.max-address: 0x9c4 --> 2500 IP
cfg.general.max-address-group: 0xfa --> 250
cfg.general.max-address-per-group: 0x1f4 --> 500
peer.cfg.general.max-address: 0x9c4
peer.cfg.general.max-address-group: 0xfa
peer.cfg.general.max-address-per-group: 0x1f4

I am confused with the limits of the lists. I can not predict how big the feed can become. If it's bigger than the limits, does the Palo Alto read the list as much as I can or can not read it?

With these values, how many lists can I have?
How many values can this list have?
In global, how many ip can I have?

Regards

[lmori]

Hi @Sistemas_SanLucar,

check here:

https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/policy/use-a-dynamic-block-list-in-p...

Your PA-500 with PAN-OS 6.1 can have:

- up to 10 Dynamic Block Lists

- each DBL can contain up to (max-addresses-300) entries = 2200 IPs

Note: this has changed in PAN-OS 7.1, check @Greg_R previous post.

In MineMeld you can use the "n" and "s" feed parameter to slice a feed. Example:

https://<minemeld ip>/feeds/inboundhc => full list of indicators

https://<minemeld ip>/feeds/inboundhc?n=2200 => first 2200 entries in the list

https://<minemeld ip>/feeds/inboundhc?s=2200&n=2200 => entries 2201-4400 in the list

Note: feeds by default are sorted based on the update time, this means that when you retrieve the first N entries these will be the N most recent entries.

Hope it helps,

luigi