PA specifiations and limitations

[bdaussin]

Hello,

We are using Panorama to manage all our PA devices. Depending on our needs, we use plateforms from PA500 to PA5050.  Last week we tried to commit a change to a PA500 and we get the message : address group limit exceeded !!!! At the moment we have 253 address groups. So the limit seems to be 250 address groups for a PA500.

Could you give us this kind of limitations for each of you device. I didn't find anything about this.

Thanks,

[markjx]

Good luck, man. I've asked for stuff like this for years and just get shot down. Their school of thought is just to let the customer experience an outage and then try to figure out why.

[rnitz]

The address group limit for the PA-500 is 250.

[bdaussin]

By using the command "show system state", we are able to have a look at all limitations !!

What i do not anderstand is : Why Panaroma send all objects to Firewall even if these Objects are not used within the policies !! It's really not optimal.

Is there any plan to change this and send only the usefull objects ? It's really not efficient for large companies having to deal with both large and small sites and who want to use Panorama.

Thanks a lot.

[markjx]

I believe that 4.0 has some functionality around scoping objects to only go to the firewalls which actually use them.

[bdaussin]

Thanks for this answer.

I took a look at Panorama (v4) but I did'nt find this feature :smileyconfused:

Can someone give more details about this feature ?

[jcostello]

Clarification question. Do you have the firewalls in separate Device Groups on Panorama?

Thanks

James

[bdaussin]

Yes we do have device groups. In fact, for all plateforms (except PA500) we use vsys and device-groups.

Thanks in advance.