Total number of profiles (xx) exceeds platform capacity (xx)

[JohnJones]

Some of our smaller PAs are starting to have their commits fail do to the number of profiles configured in Panorama.  The error I receive is "Total number of profiles (xx) exceeds platform capacity (xx)".  I followed this link but it does not seem to have helped: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm0DCAS

This had me disable the "Share Unused Address and Service Objects with Devices".  Even though this has been disabled all of the unused  security profiles are still applied to my firewalls where they are not needed.  Is there something else that can be done to remove the unused security profiles?

-Thanks!

[BPry]

@JohnJones,

So profile is actually every policy in your entire rulebase; Security, NAT, QoS, PBF, Decryption, Tunnel Inspection, Application Override, Atuh, and DoS Protection. Remove any policies that you aren't actually using on the device and you'll be good to go.

View Max Profiles on device.

'show system state filter cfg.general.max* | match profile'

[Remo]

---

@BPry wrote:

@JohnJones,

So profile is actually every policy in your entire rulebase; Security, NAT, QoS, PBF, Decryption, Tunnel Inspection, Application Override, Atuh, and DoS Protection.

---

@BPry are you sure? Doesn't this mean security profiles like url, antivirus, anrispyware, vulnerability? Because these profiles are still shared with the firewalls even if you have the option "share unused ..." disabled (this option is only for address-, addressgroup-, service- and servicegroupobjects)

[BPry]

@Remo,

Nope, I was actually just modifying this. Really bad article on the knowledgebase that once I was looking at it more shouldn't exist. Profile accounts for the security profiles as you mention.