Maximum number of addresses exceeded

[AhamadullahM]

Hi All,

We are facing the below issue while committing and pushing the configuration to the device from Panorama. We have already "unchecked Share Unused Address and Service Objects with Devices" but still we are facing the issue Kindly help to resolve the issue.

• Details:
• . Validation Error:
• . address constraints failed : Maximum number of addresses exceeded
• . address is invalid
• . Warning: No Valid DNS Security License
• . Error: Number of addresses, dynamic groups, external-ip-lists, external-predefined-ip-lists and predefined ip-block-lists (3520) exceeds platform capacity (3500)
• . (Module: device)
• . client device phase 1 failure
• . Commit failed

Thanks you all for your prompt responses

[TomYoung]

Hi @AhamadullahM ,

The problem may not be your number of addresses or dynamic groups, but rather the number of entries in your external-ip-lists, external-predefined-ip-lists and predefined ip-block-lists.

On the NGFW (not Panorama), click on each custom EDL under Objects > External Dynamic List (or External Block List) and then click on List Entries and Exceptions and add up the total number of entries for all of them.

What PAN-OS version and platform do you have?

Thanks,

Tom

[AhamadullahM]

Hi ,

The current PAN-OS version is 10.1.5

I have added more info, We have 3 administrator profiles and two administrator profiles have the facing issue. 

[ozheng]

Hello AhamadullahM,

You need to "cleanup" your config : remove the address objects you are not needing anymore, aggregate some entries (2 IP address in the same subnet can be directly defined in a subnet for instance).

For now, you simply need to remove 20 address objects.

Or you consider to upgrade to a platform with higher platform limit.

Also, if you are in multi-vsys, upgrading to 10.2 can save you some objects (thank to how shared objects are managed from 10.2).

Olivier