Confused over EBL size limit

[networkadmin]

We have a 3020 running 7.0.8 and are experimenting with MineMeld.

As soon as we get close to 5k IPs on the combined EBLs we get an error on a EBL refresh that it's been truncated as it's over the limit.

Palo Alto's own KB suggests that on an entry level PA-200 there is a limit of 50k items on all EBLs combined.

https://live.paloaltonetworks.com/t5/Learning-Articles/Working-with-External-Block-List-EBL-Formats-...

Support are telling me that the limit on 3020 is 5k which doesn't seem to make sense as a) why would a 200 support more than a 3020 and b) what's the point of something like minmeld if you can only have 5000 IPs?

Any clarification would be great.

[Sistemas_SanLucar]

I continue with the doubt. If the list has 5000 ip. What does Palo Alto do?

Does it only read from the list the ip that it allows?
Does it give error and does not read anything?

Thank you

[Greg_R]

If the list is larger than the firewall can support, it will download its max allowed (starting at the top and working down) and then drop anything longer than it can accomdate. At this point it will also throw a warning that the max limit has been hit. I'm trying to dig up the exact message, but I believe it was posted in the forums before.

[Sistemas_SanLucar]

Thank you.

[kevin_thys]

Hi Luigi,

I tried splitting the list but still getting error that maximum in the list is exceeded.

Config firewall:

xxx-Ransomware-IPv4-01 {
recurring {
hourly {
at 45;
}
}
url https://ip/feeds/xxx-Ransomware-IPv4?n=4600;
type ip;
description "Ransomware Minemeld list Medium confidence level";
}
xxx-Ransomware-IPv4-02 {
recurring {
hourly {
at 46;
}
}
url https://ip/feeds/xxx-Ransomware-IPv4?s=4600&n=4600;
type ip;
}
xxx-Ransomware-IPv4-03 {
recurring {
hourly {
at 47;
}
}
url https://ip/feeds/xxx-Ransomware-IPv4?s=9200&n=4600;
type ip;
}

Running lateste Minemeld and PAN-OS 7.0.9.

Error received when commit is done:

• EBL(vsys1/xxx-Ransomware-IPv4-02) Exceeding max number of ips at line 4701

When I check in CLI it is starting at 4600 but not ending untill the end of the list.

I think that the parameter is n=4600 is not working. 

[lmori]

Just tested this and works for me. Could you try this and paste the output ?

$ curl -s https://<minemeld>/feeds/inboundFeedMC\?s=4600\&n=4600  | wc
    4600    4600  133432

Thanks !