Is there a limit to the number of objects within a dynamic address group?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Is there a limit to the number of objects within a dynamic address group?

L0 Member

I'm working on doing some clean up, and I want to take advantage of dynamic address groups. I have 943 address objects tagged and one dynamic group. 

When I monitor the logs, I see some traffic bypassing my rule and going to rules below. I checked the address objects and they are tagged.

As a test I put all 943 address objects into a static group. I created a new tag, tagged the static group, and then create a new dynamic group. I put a new test rule in, and all the traffic now hitting this rule.

I'm not crazy about the solution, because it feels like I just created a group within a group but it's working so far. That's why I wonder if there is a limit with how many objects can be inside a dynamic group.

I'm working with a PA-5260. 

2 REPLIES 2

Community Team Member

Hi @PaulAmmann ,

 

As far as I can see 943 objects in an address group shouldn't be a problem for the PA-52xx.  As per the products comparison's page, the PA-5260 can handle 2500 members per address group:

 

https://www.paloaltonetworks.com/products/product-selection

 

You can also check this on your device with the following command:

 

admin@PA-VM> show system state | match cfg.general.max-address

cfg.general.max-address: 10000
cfg.general.max-address-group: 0x3e8
cfg.general.max-address-per-group: 0x9c4

 

where you might want to convert hex to dec:

 

0x3e8 = 1000

0x9c4 = 2500

 

Cheers,

-Kiwi.

 
LIVEcommunity team member, CISSP
Cheers,
Kiwi
Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

L0 Member

I have the same problem. I have a PA-5250 who is using a single DAG group with more than 70,000 address objects as its members. The limit for member-per-address-group is 2,500 for PA-5250.

 

It was working fine but then we made a change on rule-base (some another policy)  and then it stopped working.

 

  • 5584 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!