08-17-2016 11:07 AM
We have a 3020 running 7.0.8 and are experimenting with MineMeld.
As soon as we get close to 5k IPs on the combined EBLs we get an error on a EBL refresh that it's been truncated as it's over the limit.
Palo Alto's own KB suggests that on an entry level PA-200 there is a limit of 50k items on all EBLs combined.
Support are telling me that the limit on 3020 is 5k which doesn't seem to make sense as a) why would a 200 support more than a 3020 and b) what's the point of something like minmeld if you can only have 5000 IPs?
Any clarification would be great.
11-29-2016 07:53 AM
11-29-2016 07:57 AM
If the list is larger than the firewall can support, it will download its max allowed (starting at the top and working down) and then drop anything longer than it can accomdate. At this point it will also throw a warning that the max limit has been hit. I'm trying to dig up the exact message, but I believe it was posted in the forums before.
11-29-2016 08:14 AM
02-08-2017 12:14 PM - edited 02-08-2017 12:15 PM
I tried splitting the list but still getting error that maximum in the list is exceeded.
description "Ransomware Minemeld list Medium confidence level";
Running lateste Minemeld and PAN-OS 7.0.9.
Error received when commit is done:
When I check in CLI it is starting at 4600 but not ending untill the end of the list.
I think that the parameter is n=4600 is not working.
02-08-2017 01:25 PM
Just tested this and works for me. Could you try this and paste the output ?
$ curl -s https://<minemeld>/feeds/inboundFeedMC\?s=4600\&n=4600 | wc 4600 4600 133432
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!