I'm working on doing some clean up, and I want to take advantage of dynamic address groups. I have 943 address objects tagged and one dynamic group.
When I monitor the logs, I see some traffic bypassing my rule and going to rules below. I checked the address objects and they are tagged.
As a test I put all 943 address objects into a static group. I created a new tag, tagged the static group, and then create a new dynamic group. I put a new test rule in, and all the traffic now hitting this rule.
I'm not crazy about the solution, because it feels like I just created a group within a group but it's working so far. That's why I wonder if there is a limit with how many objects can be inside a dynamic group.
I'm working with a PA-5260.
Hi @PaulAmmann ,
As far as I can see 943 objects in an address group shouldn't be a problem for the PA-52xx. As per the products comparison's page, the PA-5260 can handle 2500 members per address group:
You can also check this on your device with the following command:
admin@PA-VM> show system state | match cfg.general.max-address cfg.general.max-address: 10000 cfg.general.max-address-group: 0x3e8 cfg.general.max-address-per-group: 0x9c4
where you might want to convert hex to dec:
0x3e8 = 1000
0x9c4 = 2500
I have the same problem. I have a PA-5250 who is using a single DAG group with more than 70,000 address objects as its members. The limit for member-per-address-group is 2,500 for PA-5250.
It was working fine but then we made a change on rule-base (some another policy) and then it stopped working.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!