Is there a limit to the number of objects within a dynamic address group?

[PaulAmmann]

I'm working on doing some clean up, and I want to take advantage of dynamic address groups. I have 943 address objects tagged and one dynamic group. 

When I monitor the logs, I see some traffic bypassing my rule and going to rules below. I checked the address objects and they are tagged.

As a test I put all 943 address objects into a static group. I created a new tag, tagged the static group, and then create a new dynamic group. I put a new test rule in, and all the traffic now hitting this rule.

I'm not crazy about the solution, because it feels like I just created a group within a group but it's working so far. That's why I wonder if there is a limit with how many objects can be inside a dynamic group.

I'm working with a PA-5260. 

[kiwi]

Hi @PaulAmmann ,

As far as I can see 943 objects in an address group shouldn't be a problem for the PA-52xx.  As per the products comparison's page, the PA-5260 can handle 2500 members per address group:

https://www.paloaltonetworks.com/products/product-selection

You can also check this on your device with the following command:

admin@PA-VM> show system state | match cfg.general.max-address

cfg.general.max-address: 10000
cfg.general.max-address-group: 0x3e8
cfg.general.max-address-per-group: 0x9c4

where you might want to convert hex to dec:

0x3e8 = 1000

0x9c4 = 2500

Cheers,

-Kiwi.

[LuckyRangra]

I have the same problem. I have a PA-5250 who is using a single DAG group with more than 70,000 address objects as its members. The limit for member-per-address-group is 2,500 for PA-5250.

It was working fine but then we made a change on rule-base (some another policy)  and then it stopped working.