PA-4020 max NAT rule limit?

[debsPal0]

I am getting very close to the 1000 max NAT rule limit on my PA-4020's, are there any plans to increase this limit in future releases of PANOS or is my only option to upgrade to a PA-4050?

[gswcowboy · Accepted solution]

It appears the 4020 is still limited and the 4050 is a recourse @4K. Please defer to your Sales SE if it's in the roadmap.

Regards,

Renato

[debsPal0]

I'll contact my sales SE this morning. One final question - is there a command that I could run via CLI that would tell me the total number of NAT rules currently configured?

Regards,

James.

[gswcowboy]

I apologize James but I wasn't able to determine if there's a CLI command to provide you a counter of sorts. I'll keep checking and confirm either way. I do know that the system will relay an error message when the limit is reached upon making a commit.

'Constraints failed for entry: Maximum number of rules reached."

Regards,

Renato

[gswcowboy]

Hi James,

Unfortunately, there doesn't appear to be a CLI command that would provide a counter to indicate the number of NAT policies created. Recourse would be viewing the counter via GUI. If you'd like, you can submit a feature request for a CLI command to show this counter.

Regards,

Renato

[schiang1]

> show resource limit policies | match NAT

This will display the current NAT rules configured

[gswcowboy]

Thanks for the help! Follow up question. On a 4050, I ran the command but it did not provide an output even though I have NAT policy configured. Also, as a follow up, how do you configure max rules?

admin@ROUTER-2(active)> show resource limit policies
policy                    current rules   max rules------------------------- --------------- ---------------Security                  1               not configured

admin@ROUTER-2(active)> show resource limit policies | match natadmin@ROUTER-2(active)>

-Renato

[rapoint_person]

This shows the max configured at least:

show system state filter cfg.general.max* | match nat

then combine with show resource limit policies (as this command does not show the max, at least not the box I'm on)

[schiang1]

Renato,

Do you have virtual systems configured?

re:max rules, I noticed that too. I believe this is also related and configured per vsys.

Thanks

sc